Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3393 | post-to-csv (WordPress plugin) | The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV i | critical | 9.8 | 2% |
| CVE-2016-1902 | symfony/security, symfony/security-core, symfony/symfony | Symfony Cryptographic Vulnerability | high | 7.5 | 2% |
| CVE-2015-6828 | security-audit (WordPress plugin) | The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTP | medium | 6.8 | 2% |
| CVE-2013-1836 | moodle/moodle | Moodle does not properly manage privileges for WebDAV repositories | medium | 0.0 | 2% |
| CVE-2016-6635 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPre | high | 8.8 | 2% |
| CVE-2021-24224 | easy-form-builder-by-bitware (WordPress plugin) | The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not ha | high | 8.8 | 2% |
| CVE-2021-24253 | classyfrieds (WordPress plugin) | The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only chec | high | 8.8 | 2% |
| CVE-2015-7357 | udesign (WordPress theme) | Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to in | medium | 6.1 | 2% |
| CVE-2021-24436 | w3-total-cache (WordPress plugin) | The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the | medium | 6.1 | 2% |
| CVE-2011-4285 | moodle/moodle | Moodle Incorrect Default Settings | medium | 0.0 | 2% |
| CVE-2014-7837 | moodle/moodle | Moodle allows attackers to remove wiki pages | medium | 0.0 | 2% |
| CVE-2022-1505 | rsvpmaker (WordPress plugin) | The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user s | critical | 9.8 | 2% |
| CVE-2020-26934 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting (XSS) | medium | 6.1 | 2% |
| CVE-2016-9449 | drupal/core, drupal/drupal | Drupal sensitive information disclosure | medium | 4.3 | 2% |
| CVE-2021-24857 | totop-link (WordPress plugin) | The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Ob | critical | 9.8 | 2% |
| CVE-2020-28339 | usc-e-shop (WordPress plugin) | The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. Ther | high | 7.5 | 2% |
| CVE-2021-3689 | yiisoft/yii2-dev | Use of Insufficiently Random Values in yiisoft/yii2-dev | high | 7.5 | 2% |
| CVE-2015-9449 | microblog-poster (WordPress plugin) | The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php accou | high | 7.2 | 2% |
| CVE-2016-10943 | zx-csv-upload (WordPress plugin) | The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter. | high | 7.2 | 2% |
| CVE-2012-3385 | WordPress core | WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or con | medium | 5.0 | 2% |
| CVE-2012-4421 | WordPress core | The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows | medium | 4.0 | 2% |
| CVE-2018-9034 | relevanssi (WordPress plugin) | Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject | medium | 5.4 | 2% |
| CVE-2023-7165 | jetbackup (WordPress plugin) | The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certai | high | 7.5 | 2% |
| CVE-2010-2958 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting vulnerability | medium | 0.0 | 2% |
| CVE-2021-24171 | woocommerce-upload-files (WordPress plugin) | The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was p | critical | 9.8 | 2% |
| CVE-2007-4154 | WordPress core | SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands v | medium | 6.5 | 2% |
| CVE-2020-10793 | codeigniter4/framework | CodeIgniter Improper Privilege Management | high | 8.8 | 2% |
| CVE-2018-7269 | yiisoft/yii2-dev, yiisoft/yii2 | Yii SQL injection vulnerability | critical | 9.8 | 2% |
| CVE-2021-28583 | magento/community-edition, magento/project-community-edition | Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats | high | 7.5 | 2% |
| CVE-2010-5101 | typo3/cms | TYPO3 Directory Traversal vulnerability | medium | 0.0 | 2% |
| CVE-2014-8087 | post-highlights (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 2% |
| CVE-2014-8584 | player (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPres | medium | 4.3 | 2% |
| CVE-2021-24221 | quiz-and-survey-master (WordPress plugin) | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET paramet | high | 8.8 | 2% |
| CVE-2021-24363 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside | medium | 4.9 | 2% |
| CVE-2019-17072 | new-contact-form-widget (WordPress plugin) | The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query | critical | 9.8 | 2% |
| CVE-2015-1039 | zf-commons/zfc-user | ZF-Commons ZfcUser Vulnerable to XSS in Login Redirect | medium | 5.3 | 2% |
| CVE-2017-6377 | drupal/core, drupal/drupal | Drupal editor module incorrectly checks access to inline private files | high | 7.5 | 2% |
| CVE-2022-2067 | francoisjacquet/rosariosis | SQL Injection in RosarioSIS | critical | 9.1 | 2% |
| CVE-2019-16219 | WordPress core | WordPress before 5.2.3 allows XSS in shortcode previews. | medium | 6.1 | 2% |
| CVE-2014-9292 | jrss-widget (WordPress plugin) | Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attacker | medium | 5.8 | 2% |
| CVE-2014-8749 | bulletproof-security (WordPress plugin) | Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPre | medium | 5.0 | 2% |
| CVE-2021-36909 | wp-reset-pro (WordPress plugin) | Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe | high | 8.8 | 2% |
| CVE-2019-8154 | magento/community-edition, magento/product-community-edition | Magento remote code execution vulnerability | high | 8.8 | 2% |
| CVE-2022-24828 | composer/composer | Missing input validation can lead to command execution in composer | high | 8.3 | 2% |
| CVE-2016-10958 | estatik (WordPress plugin) | The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php. | high | 7.5 | 2% |
| CVE-2015-4557 | nextend-twitter-connect (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Conne | medium | 6.1 | 2% |
| CVE-2015-10134 | simple-backup (WordPress plugin) | The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_b | high | 7.5 | 2% |
| CVE-2019-19133 | csshero (WordPress plugin) | The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails | medium | 6.1 | 2% |
| CVE-2020-20627 | givewp (WordPress plugin) | The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings c | medium | 5.3 | 2% |
| CVE-2012-2153 | drupal/drupal | Drupal improper access restrictions | medium | 0.0 | 2% |