Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-24406 | magento/community-edition | Magento information disclosure vulnerability | low | 3.7 | 2% |
| CVE-2020-4041 | bolt/bolt | The filename of uploaded files vulnerable to stored XSS | high | 7.4 | 2% |
| CVE-2016-10923 | woocommerce-store-toolkit (WordPress plugin) | The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation. | critical | 9.8 | 2% |
| CVE-2019-15111 | wp-front-end-profile (WordPress plugin) | The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue. | critical | 9.8 | 2% |
| CVE-2021-21408 | smarty/smarty | Access to restricted PHP code by dynamic static class access in smarty | high | 8.8 | 2% |
| CVE-2015-1000013 | csv2wpec-coupon (WordPress plugin) | Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1 | high | 7.8 | 2% |
| CVE-2015-7668 | easy2map (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote att | medium | 6.1 | 2% |
| CVE-2023-34252 | getgrav/grav | Grav Server-side Template Injection (SSTI) via Twig Default Filters | high | 7.2 | 2% |
| CVE-2023-34253 | getgrav/grav | Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability | high | 7.2 | 2% |
| CVE-2015-1879 | google-document-embedder (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arb | medium | 4.3 | 2% |
| CVE-2017-18583 | post-pay-counter (WordPress plugin) | The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection. | critical | 9.8 | 2% |
| CVE-2018-21005 | bbp-move-topics (WordPress plugin) | The bbp-move-topics plugin before 1.1.6 for WordPress has code injection. | critical | 9.8 | 2% |
| CVE-2014-2333 | lazyest-gallery (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitra | low | 2.6 | 2% |
| CVE-2014-10384 | memphis-documents-library (WordPress plugin) | The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion. | critical | 9.8 | 2% |
| CVE-2019-15867 | slick-popup (WordPress plugin) | The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber ca | high | 8.8 | 2% |
| CVE-2026-30880 | baserproject/basercms | baserCMS has OS command injection vulnerability in installer | critical | 0.0 | 2% |
| CVE-2021-24384 | joomsport (WordPress plugin) | The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated us | critical | 9.8 | 2% |
| CVE-2022-0346 | xml-sitemap-generator (WordPress plugin) | The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thu | medium | 6.1 | 2% |
| CVE-2013-3262 | download-monitor (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attack | medium | 4.3 | 2% |
| CVE-2015-5485 | eventbrite-tickets (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plug | medium | 4.3 | 2% |
| CVE-2019-15074 | mantisbt/mantisbt | MantisBT allows cross-site scripting (XSS) via crafted filename | medium | 0.0 | 2% |
| CVE-2023-2017 | shopware/core, shopware/platform | Shopware Has Improper Control of Generation of Code in Twig rendered views | high | 8.8 | 2% |
| CVE-2022-0633 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to | medium | 6.5 | 2% |
| CVE-2011-4287 | moodle/moodle | Moodle does not force password changes for autosubscribed users | medium | 0.0 | 2% |
| CVE-2024-11236 | PHP engine | Integer overflow causing out-of-bounds write in DB quoters / ldap_escape | critical | 9.8 | 2% |
| CVE-2015-5532 | paid-memberships-pro (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote att | medium | 6.1 | 2% |
| CVE-2022-24663 | php-everywhere (WordPress plugin) | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by an | critical | 9.9 | 2% |
| CVE-2015-9435 | oauth2-provider (WordPress plugin) | The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers. | critical | 9.8 | 2% |
| CVE-2018-10891 | moodle/moodle | Moodle XSS Vulnerability | high | 7.3 | 2% |
| CVE-2014-4549 | sagepay-direct-for-woocommerce-payment-gateway (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before | medium | 4.3 | 2% |
| CVE-2014-6243 | ewww-image-optimizer (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arb | medium | 4.3 | 2% |
| CVE-2018-19456 | wpbackupplus (WordPress plugin) | The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from serve | high | 7.5 | 2% |
| CVE-2022-0288 | ad-inserter (WordPress plugin), ad-inserter-pro (WordPress plugin) | The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_s | medium | 6.1 | 2% |
| CVE-2009-3635 | typo3/cms | TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential | medium | 0.0 | 2% |
| CVE-2014-9461 | cart66-lite (WordPress plugin) | Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated user | low | 3.5 | 2% |
| CVE-2015-9334 | email-newsletter (WordPress plugin) | The email-newsletter plugin through 20.15 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2020-5590 | ec-cube/ec-cube | EC-CUBE Directory traversal vulnerability | high | 8.1 | 2% |
| CVE-2021-24219 | focusblog (WordPress plugin), ignition (WordPress plugin), luxe (WordPress plugin) +17 more | The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress | medium | 5.3 | 2% |
| CVE-2012-6628 | newsletter-manager (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to in | medium | 4.3 | 2% |
| CVE-2013-1407 | events-manager (WordPress plugin), events-manager-pro (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for | medium | 4.3 | 2% |
| CVE-2013-6342 | tweet-blender (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Tweet Blender plugin before 4.0.2 for WordPress allows remote attackers to inject arbitrary | medium | 4.3 | 2% |
| CVE-2020-36156 | ultimate-member (WordPress plugin) | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update | critical | 9.9 | 2% |
| CVE-2023-6266 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the B | high | 7.5 | 2% |
| CVE-2014-8724 | w3-total-cache (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remot | medium | 4.3 | 2% |
| CVE-2015-5481 | gd-bbpress-attachments (WordPress plugin) | Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote att | medium | 4.3 | 2% |
| CVE-2012-6634 | WordPress core | wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachm | medium | 6.4 | 2% |
| CVE-2013-1758 | watermark (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2018-1000131 | wp-support-plus-responsive-ticket-system (WordPress plugin) | Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the funct | critical | 9.8 | 2% |
| CVE-2018-10890 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 2% |
| CVE-2016-5833 | WordPress core | Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before | medium | 6.1 | 2% |