Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-34515 | spatie/image-optimizer | image-optimizer allows PHAR deserialization | high | 8.8 | 2% |
| CVE-2011-1941 | phpmyadmin/phpmyadmin | phpMyAdmin Open Redirect in redirector | medium | 0.0 | 2% |
| CVE-2020-8549 | strong-testimonials (WordPress plugin) | Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stea | medium | 6.1 | 2% |
| CVE-2015-3175 | moodle/moodle | Moodle Arbitrary Redirect | medium | 0.0 | 2% |
| CVE-2018-3814 | craftcms/cms | Craft CMS PHP Code Injection Vulnerability | high | 8.8 | 2% |
| CVE-2020-36848 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Ex | high | 7.5 | 2% |
| CVE-2022-0963 | microweber/microweber | Unrestricted XML files leading to cross-site scripting in Microweber | medium | 5.4 | 2% |
| CVE-2020-11509 | wp-lead-plus-x (WordPress plugin) | An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arb | medium | 6.1 | 2% |
| CVE-2012-6431 | symfony/http-foundation, symfony/routing, symfony/security +1 more | Symfony Allows URI Restrictions Bypass Via Double-Encoded String | medium | 0.0 | 2% |
| CVE-2024-11740 | download-manager (WordPress plugin) | The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. T | high | 7.3 | 2% |
| CVE-2021-24228 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPr | critical | 9.6 | 2% |
| CVE-2016-10917 | search-everything (WordPress plugin) | The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CV | critical | 9.8 | 2% |
| CVE-2017-17897 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in comm/multiprix.php | critical | 9.8 | 2% |
| CVE-2017-17899 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in adherents/subscription/info.php | critical | 9.8 | 2% |
| CVE-2017-17900 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in fourn/index.php | critical | 9.8 | 2% |
| CVE-2019-10913 | symfony/http-foundation, symfony/symfony | Invalid HTTP method overrides allow possible XSS or other attacks in Symfony | critical | 9.8 | 2% |
| CVE-2014-0217 | moodle/moodle | Moodle does not check for the moodle/course:viewhiddencourses capability | medium | 0.0 | 2% |
| CVE-2015-9301 | liveforms (WordPress plugin) | The liveforms plugin before 3.2.0 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9310 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues. | critical | 9.8 | 2% |
| CVE-2016-10887 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues. | critical | 9.8 | 2% |
| CVE-2016-10888 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues. | critical | 9.8 | 2% |
| CVE-2019-15659 | pie-register (WordPress plugin) | The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969. | critical | 9.8 | 2% |
| CVE-2020-24404 | magento/community-edition | Magento 2 Community Edition vulnerable to Improper Authorization | low | 2.7 | 2% |
| CVE-2022-1007 | advanced-booking-calendar (WordPress plugin) | The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an | medium | 6.1 | 2% |
| CVE-2013-5958 | symfony/polyfill, symfony/polyfill-php55, symfony/security +1 more | Symfony Denial of Service Via Long Password Hashing | medium | 0.0 | 2% |
| CVE-2016-11002 | extra (WordPress theme) | The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation. | high | 8.8 | 2% |
| CVE-2016-11003 | bloom (WordPress plugin) | The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation. | high | 8.8 | 2% |
| CVE-2016-11004 | monarch (WordPress plugin) | The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation. | high | 8.8 | 2% |
| CVE-2017-9069 | modx/revolution | MODX Revolution allows overwriting .htaccess | high | 8.8 | 2% |
| CVE-2016-10971 | membersonic (WordPress plugin) | The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is re | critical | 9.8 | 2% |
| CVE-2018-20583 | league/commonmark | PHP League CommonMark vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 2% |
| CVE-2015-2270 | moodle/moodle | Moodle allows attackers to obtain sensitive course information | medium | 0.0 | 2% |
| CVE-2015-3176 | moodle/moodle | Moodle allows attackers obtain full-name information | medium | 0.0 | 2% |
| CVE-2016-4423 | symfony/security, symfony/security-http, symfony/symfony | Symphony Denial of Service Via Overlong Usernames | high | 7.5 | 2% |
| CVE-2010-4962 | dmk/webkitpdf | Webkit PDFs for TYPO3 allows remote attackers to execute arbitrary commands | high | 0.0 | 2% |
| CVE-2014-6300 | phpmyadmin/phpmyadmin | phpMyAdmin micro history Implementation XSS Vulnerability | medium | 0.0 | 2% |
| CVE-2021-36916 | hide-my-wp (WordPress plugin) | The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieve | high | 8.6 | 2% |
| CVE-2015-5682 | powerplay-gallery (WordPress plugin) | upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to | high | 7.5 | 2% |
| CVE-2021-24892 | advanced-forms (WordPress plugin) | Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change | high | 8.8 | 2% |
| CVE-2021-41800 | mediawiki/core | MediaWiki allows a denial of service | medium | 5.3 | 2% |
| CVE-2017-11365 | symfony/security, symfony/security-core, symfony/symfony | Symfony Incorrect Access Control | critical | 9.8 | 2% |
| CVE-2024-3217 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all vers | high | 8.8 | 2% |
| CVE-2021-4368 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This i | critical | 9.9 | 2% |
| CVE-2022-4298 | wholesale-market (WordPress plugin) | The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to genera | critical | 9.8 | 2% |
| CVE-2019-8114 | magento/community-edition, magento/project-community-edition, magento/magento1ce +2 more | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2019-8119 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2016-6618 | phpmyadmin/phpmyadmin | phpMyAdmin Denial of service (DOS) attack in transformation feature | medium | 6.5 | 2% |
| CVE-2023-5311 | wp-extra (WordPress plugin) | The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() fun | high | 8.8 | 2% |
| CVE-2020-22277 | import-users-from-csv-with-meta (WordPress plugin) | Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. | high | 8.0 | 2% |
| CVE-2014-5204 | WordPress core | wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the | medium | 6.8 | 2% |