Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6750 | clone (WordPress plugin) | The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible | high | 7.5 | 2% |
| CVE-2022-2376 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated a | medium | 5.3 | 2% |
| CVE-2014-100007 | hk-exif-tags (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject ar | medium | 4.3 | 2% |
| CVE-2014-9174 | google-analytics-for-wordpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress | medium | 4.3 | 2% |
| CVE-2015-0901 | flashy (WordPress theme) | Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitra | medium | 4.3 | 2% |
| CVE-2015-1383 | geo-mashup (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attacker | medium | 4.3 | 2% |
| CVE-2024-5975 | cz-loan-management (WordPress plugin) | The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via | critical | 9.1 | 2% |
| CVE-2018-20973 | companion-auto-update (WordPress plugin) | The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion. | critical | 9.8 | 2% |
| CVE-2020-12669 | dolibarr/dolibarr | Incorrect Authorization in Dolibarr | high | 8.8 | 2% |
| CVE-2020-11727 | woo-order-export-lite (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote a | medium | 6.1 | 2% |
| CVE-2019-7876 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 2% |
| CVE-2019-7885 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 2% |
| CVE-2015-9324 | easy-digital-downloads (WordPress plugin) | The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2020-6168 | minimal-coming-soon-maintenance-mode (WordPress plugin) | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable | high | 7.6 | 2% |
| CVE-2020-29303 | directories-pro (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arb | medium | 6.1 | 2% |
| CVE-2018-21007 | woo-confirmation-email (WordPress plugin) | The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads. | critical | 9.8 | 2% |
| CVE-2021-24314 | goto (WordPress plugin) | The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in | critical | 9.8 | 2% |
| CVE-2022-39296 | melisplatform/melis-asset-manager | melisplatform/melis-asset-manager vulnerable to Path Traversal | high | 7.5 | 2% |
| CVE-2021-24312 | wp-super-cache (WordPress plugin) | The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the set | high | 7.2 | 2% |
| CVE-2014-7152 | yikes-inc-easy-mailchimp-extender (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to injec | medium | 4.3 | 2% |
| CVE-2022-1916 | woot (WordPress plugin) | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not saniti | medium | 6.1 | 2% |
| CVE-2014-8491 | grand-flagallery (WordPress plugin) | The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagaller | medium | 5.3 | 2% |
| CVE-2019-8116 | magento/product-community-edition | PRODSECBUG-2456: Broken authentication and session managememt | unknown | 0.0 | 2% |
| CVE-2014-100026 | aprils-super-functions-pack (WordPress plugin) | Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote a | medium | 4.3 | 2% |
| CVE-2021-36043 | magento/community-edition, magento/project-community-edition | Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension | high | 8.0 | 2% |
| CVE-2017-6922 | drupal/core, drupal/drupal | Drupal core access bypass vulnerability | medium | 6.5 | 2% |
| CVE-2016-4855 | adodb/adodb-php | ADOdb Cross-site scripting vulnerability in old test script | medium | 6.1 | 2% |
| CVE-2018-17960 | typo3/cms, typo3/cms-core | Ckeditor XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2022-3242 | microweber/microweber | Microweber Cross-site Scripting can result in redirection to a malicious site | medium | 6.1 | 2% |
| CVE-2015-9398 | gocodes (WordPress plugin) | The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection. | high | 8.8 | 2% |
| CVE-2015-9400 | wordpress-meta-robots (WordPress plugin) | The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection. | high | 8.8 | 2% |
| CVE-2015-9465 | yet-another-stars-rating (WordPress plugin) | The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id paramete | high | 8.8 | 2% |
| CVE-2016-10950 | sirv (WordPress plugin) | The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter. | high | 8.8 | 2% |
| CVE-2019-17104 | centreon/centreon | Centreon Does Not Set HTTPOnly Flag | high | 7.5 | 2% |
| CVE-2019-17214 | webarx (WordPress plugin) | The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI. | high | 7.5 | 2% |
| CVE-2022-0271 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_backgro | medium | 6.1 | 2% |
| CVE-2025-69212 | devcode-it/openstamanager | OpenSTAManager has an OS Command Injection in P7M File Processing | critical | 0.0 | 2% |
| CVE-2014-5185 | quartz-plugin (WordPress plugin) | SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execu | medium | 6.0 | 2% |
| CVE-2022-1756 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. | medium | 6.1 | 2% |
| CVE-2016-0724 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 2% |
| CVE-2021-24987 | super-socializer (WordPress plugin) | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in | medium | 6.1 | 2% |
| CVE-2018-13447 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in product/card.php | critical | 9.8 | 2% |
| CVE-2011-0451 | ec-cube/ec-cube | EC-CUBE XSS Vulnerabilities | medium | 0.0 | 2% |
| CVE-2016-9863 | phpmyadmin/phpmyadmin | phpMyAdmin DoS Vulnerability | high | 7.5 | 2% |
| CVE-2023-35840 | studio-42/elfinder | elFinder vulnerable to path traversal in LocalVolumeDriver connector | high | 7.5 | 2% |
| CVE-2016-9860 | phpmyadmin/phpmyadmin | phpMyAdmin Denial of Service (DoS) | medium | 5.9 | 2% |
| CVE-2017-18598 | qards (WordPress plugin) | The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php. | medium | 6.1 | 2% |
| CVE-2021-25028 | event-tickets (WordPress plugin) | The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the | medium | 6.1 | 2% |
| CVE-2018-19312 | centreon/centreon | Centreon SQL Injection | high | 8.8 | 2% |
| CVE-2025-1232 | site-reviews (WordPress plugin) | The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenti | high | 8.8 | 2% |