Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-12498 | wp-live-chat-support (WordPress plugin) | The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check pr | critical | 9.8 | 2% |
| CVE-2018-1082 | moodle/moodle | Moodle Improper Authentication | high | 8.1 | 2% |
| CVE-2017-17094 | WordPress core | wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to | medium | 5.4 | 2% |
| CVE-2020-22643 | feehi/cms | Feehi CMS arbitrary file upload vulnerability | high | 7.2 | 2% |
| CVE-2022-0088 | yourls/yourls | Cross-Site Request Forgery in YOURLS | low | 3.5 | 2% |
| CVE-2026-46670 | yeswiki/yeswiki | YesWiki: Unauthenticated SQL Injection | critical | 9.8 | 2% |
| CVE-2022-31042 | guzzlehttp/guzzle, drupal/core | Failure to strip the Cookie header on change in host or HTTP downgrade | high | 7.5 | 2% |
| CVE-2022-31043 | guzzlehttp/guzzle | Fix failure to strip Authorization header on HTTP downgrade | unknown | 0.0 | 2% |
| CVE-2015-1784 | nextgen-gallery (WordPress plugin) | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we | high | 8.8 | 2% |
| CVE-2020-11067 | typo3/cms, typo3/cms-core | Insecure Deserialization in Backend User Settings in TYPO3 CMS | high | 8.8 | 2% |
| CVE-2011-4292 | moodle/moodle | Moodle allows remote authenticated users to cause a denial of service (invalid database records) | medium | 0.0 | 2% |
| CVE-2022-0320 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include | critical | 9.8 | 2% |
| CVE-2015-8476 | phpmailer/phpmailer | SMTP Injection in PHPMailer | low | 0.0 | 2% |
| CVE-2018-21013 | swape (WordPress theme) | The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors | critical | 9.8 | 2% |
| CVE-2024-13726 | themes-coder (WordPress plugin) | The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX | high | 8.6 | 2% |
| CVE-2006-1796 | WordPress core | Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly | medium | 6.8 | 2% |
| CVE-2016-10942 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via | critical | 9.8 | 2% |
| CVE-2013-7419 | js-multi-hotel (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) | medium | 4.3 | 2% |
| CVE-2020-12070 | advanced-woo-search (WordPress plugin) | The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every aja | high | 7.5 | 2% |
| CVE-2023-5212 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9. | critical | 9.6 | 2% |
| CVE-2022-2373 | simply-schedule-appointments (WordPress plugin) | The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users | medium | 5.3 | 2% |
| CVE-2022-0224 | dolibarr/dolibarr | SQL Injection in dolibarr | high | 8.3 | 2% |
| CVE-2021-24493 | shopp (WordPress plugin) | The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does n | critical | 9.8 | 2% |
| CVE-2020-4048 | WordPress core | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted | medium | 5.7 | 2% |
| CVE-2017-16244 | october/october | October CMS CSRF | high | 8.8 | 2% |
| CVE-2017-18585 | posts-in-page (WordPress plugin) | The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal. | high | 8.1 | 2% |
| CVE-2012-6623 | forumpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress a | medium | 4.3 | 2% |
| CVE-2009-3630 | typo3/cms-backend | TYPO3 Backend vulnerable to Frame Hijacking | medium | 0.0 | 2% |
| CVE-2021-24342 | jnews (WordPress plugin) | The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_bui | medium | 6.1 | 2% |
| CVE-2021-24364 | jannah (WordPress plugin) | The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before | medium | 6.1 | 2% |
| CVE-2018-11385 | symfony/security, symfony/security-http, symfony/symfony +1 more | Symfony Session Fixation Vulnerability | high | 8.1 | 2% |
| CVE-2013-2109 | wp-cleanfix (WordPress plugin) | WordPress plugin wp-cleanfix has Remote Code Execution | high | 8.8 | 2% |
| CVE-2016-11007 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval. | medium | 5.3 | 2% |
| CVE-2018-0505 | mediawiki/core | Mediawiki BotPassword can bypass CentralAuth's account lock | medium | 6.5 | 2% |
| CVE-2023-3345 | masteriyo (WordPress plugin) | The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possi | medium | 6.5 | 2% |
| CVE-2017-17093 | WordPress core | wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might all | medium | 5.4 | 2% |
| CVE-2020-5256 | ssddanbrown/bookstack | Remote Code Execution Through Image Uploads in BookStack | high | 7.9 | 2% |
| CVE-2021-39200 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | medium | 5.3 | 2% |
| CVE-2013-5098 | download-monitor (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attack | medium | 4.3 | 2% |
| CVE-2016-10995 | telvolution (WordPress plugin) | The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php. | critical | 9.8 | 2% |
| CVE-2021-24280 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from | high | 8.8 | 2% |
| CVE-2020-24143 | video-downloader-for-tiktok (WordPress plugin) | Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files | high | 7.5 | 2% |
| CVE-2020-5768 | email-subscribers-\&-newsletters (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for W | medium | 4.9 | 2% |
| CVE-2015-9402 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload. | high | 8.8 | 2% |
| CVE-2017-6817 | WordPress core | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. | medium | 5.4 | 2% |
| CVE-2023-5604 | asgaros-forum (WordPress plugin) | The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecur | critical | 9.8 | 2% |
| CVE-2014-9033 | WordPress core | Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack | medium | 6.8 | 2% |
| CVE-2022-41705 | badaso/core | Badaso vulnerable to Remote Code Execution (RCE) | critical | 9.8 | 2% |
| CVE-2009-3636 | typo3/cms-install | Typo3 API Install Tool vulnerable to Cross-site Scripting | medium | 0.0 | 2% |
| CVE-2017-18356 | woocommerce (WordPress plugin) | In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user a | high | 8.8 | 2% |