Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-2190 | moodle/moodle | Moodle sensitive information disclosure | medium | 5.3 | 2% |
| CVE-2020-25379 | recall-products (WordPress plugin) | Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an a | high | 8.8 | 2% |
| CVE-2015-9448 | sendpress (WordPress plugin) | The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter. | high | 8.8 | 2% |
| CVE-2015-9454 | smooth-slider (WordPress plugin) | The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id pa | high | 8.8 | 2% |
| CVE-2015-9460 | booking-system (WordPress plugin) | The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter. | high | 8.8 | 2% |
| CVE-2016-6621 | phpmyadmin/phpmyadmin | phpMyAdmin server-side request forgery (SSRF) | high | 8.6 | 2% |
| CVE-2014-0125 | moodle/moodle | Moodle places a session key in a URL | medium | 0.0 | 2% |
| CVE-2017-9061 | WordPress core | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error m | medium | 6.1 | 2% |
| CVE-2012-4968 | silverstripe/framework | Silverstripe XSS Vulnerabilities | medium | 0.0 | 2% |
| CVE-2020-15515 | marcwillmann/turn | Remote code execution in turn extension for TYPO3 | high | 8.8 | 2% |
| CVE-2021-4434 | social-warfare (WordPress plugin) | The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' par | critical | 10.0 | 2% |
| CVE-2015-3935 | dolibarr/dolibarr | Dolibarr ERP and CRM contain Cross-site Scripting Vulnerability | medium | 0.0 | 2% |
| CVE-2021-25016 | chaty (WordPress plugin), chaty-pro (WordPress plugin) | The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before o | medium | 6.1 | 2% |
| CVE-2019-7895 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2019-7896 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2019-7942 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE | high | 7.2 | 2% |
| CVE-2016-3164 | drupal/core, drupal/drupal | Drupal Open Redirect | high | 7.4 | 2% |
| CVE-2019-8110 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 2% |
| CVE-2019-8111 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 2% |
| CVE-2019-8122 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 2% |
| CVE-2019-8137 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 2% |
| CVE-2019-8150 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 2% |
| CVE-2020-8435 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form | high | 8.1 | 2% |
| CVE-2019-14365 | intercom (WordPress plugin) | The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about | high | 7.5 | 2% |
| CVE-2011-4291 | moodle/moodle | Moodle allows remote authenticated users to cause a denial of service (invalid database records) | medium | 0.0 | 2% |
| CVE-2018-13448 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in product/card.php | critical | 9.8 | 2% |
| CVE-2018-13449 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in product/card.php | critical | 9.8 | 2% |
| CVE-2018-13450 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in product/card.php | critical | 9.8 | 2% |
| CVE-2018-8711 | woocommerce-products-filter (WordPress plugin) | A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated | critical | 9.8 | 2% |
| CVE-2021-36564 | topthink/framework | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | 2% |
| CVE-2020-15877 | librenms/librenms | Exposure of Resource to Wrong Sphere in LibreNMS | high | 8.8 | 2% |
| CVE-2020-25698 | moodle/moodle | Improper Access Control in moodle | high | 7.5 | 2% |
| CVE-2015-9461 | awesome-filterable-portfolio (WordPress plugin) | The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_portfolio_item_page SQL injection via the item_id parameter | high | 7.2 | 2% |
| CVE-2015-9462 | awesome-filterable-portfolio (WordPress plugin) | The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter. | high | 7.2 | 2% |
| CVE-2016-10951 | fs-shopping-cart (WordPress plugin) | The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter. | high | 7.2 | 2% |
| CVE-2021-24452 | w3-total-cache (WordPress plugin) | The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" paramet | medium | 6.1 | 2% |
| CVE-2022-31090 | guzzlehttp/guzzle | Authorization header leaked to a different origin on cross-origin redirect (curl handler) | high | 7.7 | 2% |
| CVE-2016-5100 | froxlor/froxlor | Froxlor guessable password reset token | critical | 9.8 | 2% |
| CVE-2023-2834 | bookit (WordPress plugin) | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient | critical | 9.8 | 2% |
| CVE-2020-15143 | sylius/resource-bundle | Remote Code Execution in SyliusResourceBundle | high | 7.7 | 2% |
| CVE-2017-5492 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote att | high | 8.8 | 2% |
| CVE-2022-3689 | html-forms (WordPress plugin) | The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a | high | 7.2 | 2% |
| CVE-2011-2508 | phpmyadmin/phpmyadmin | phpMyAdmin Directory Traversal vulnerability | high | 0.0 | 2% |
| CVE-2014-6288 | in2code/powermail | TYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism | medium | 0.0 | 2% |
| CVE-2021-24551 | edit-comments (WordPress plugin) | The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in | critical | 9.8 | 2% |
| CVE-2017-18597 | jtrt-responsive-tables (WordPress plugin) | The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId | high | 8.8 | 2% |
| CVE-2026-55584 | phpsysinfo/phpsysinfo | phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers | high | 7.5 | 2% |
| CVE-2006-6016 | WordPress core | wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified | medium | 6.5 | 2% |
| CVE-2021-25111 | english-wordpress-admin (WordPress plugin) | The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o | medium | 6.1 | 2% |
| CVE-2020-25286 | WordPress core | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments e | medium | 5.3 | 2% |