Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0694 | advanced-booking-calendar (WordPress plugin) | The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL sta | critical | 9.8 | 2% |
| CVE-2015-3272 | moodle/moodle | Moodle open redirect vulnerability | high | 7.4 | 2% |
| CVE-2022-1724 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX act | medium | 6.1 | 2% |
| CVE-2015-9325 | visitors-online (WordPress plugin) | The visitors-online plugin before 0.4 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9326 | wp-business-intelligence-lite (WordPress plugin) | The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2016-10904 | olimometer (WordPress plugin) | The olimometer plugin before 2.57 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2012-6532 | zendframework/zendframework1 | Zend Framework XEE Vulnerability | medium | 0.0 | 2% |
| CVE-2022-1168 | jobsearch-wp-job-board (WordPress plugin) | There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1. | medium | 6.1 | 2% |
| CVE-2020-9690 | magento/community-edition | Magento observable timing discrepancy vulnerability | medium | 4.2 | 2% |
| CVE-2023-32679 | craftcms/cms | Craft CMS vulnerable to Remote Code Execution via unrestricted file extension | high | 7.2 | 2% |
| CVE-2021-24254 | college-publisher-import (WordPress plugin) | The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users | high | 7.2 | 2% |
| CVE-2017-12650 | loginizer (WordPress plugin) | SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header. | critical | 9.8 | 2% |
| CVE-2018-20714 | woocommerce (WordPress plugin) | The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allo | high | 8.1 | 2% |
| CVE-2014-0218 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | medium | 0.0 | 2% |
| CVE-2020-6009 | learndash (WordPress plugin) | LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection. | critical | 9.8 | 2% |
| CVE-2015-10139 | wordpress-learning-management-system- (WordPress theme) | The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. | high | 8.8 | 2% |
| CVE-2016-0765 | eshop-plugin (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to i | medium | 6.1 | 2% |
| CVE-2020-3715 | magento/community-edition, magento/core | Magento stored cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2020-3758 | magento/community-edition, magneto/core | Magento stored cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2020-9309 | silverstripe/cms | Silverstripe CMS malicious file upload enables script execution | high | 8.8 | 2% |
| CVE-2018-9209 | fineuploader/php-traditional-server | FineUploader php-traditional-server unauthenticated arbitrary file upload vulnerability | critical | 9.8 | 2% |
| CVE-2015-5612 | october/october | October CMS XSS In Caption Tag of Profile | medium | 0.0 | 2% |
| CVE-2014-5205 | WordPress core | wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tok | medium | 6.8 | 2% |
| CVE-2017-6921 | drupal/core, drupal/drupal | Drupal file REST resource does not properly validate | medium | 5.9 | 2% |
| CVE-2014-5191 | ckeditor/ckeditor | The Preview plugin in CKEditor allows Cross-site scripting (XSS) | medium | 0.0 | 2% |
| CVE-2018-21003 | buddyforms (WordPress plugin) | The buddyforms plugin before 2.2.8 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2022-1937 | awin-data-feed (WordPress plugin) | The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (availa | medium | 6.1 | 2% |
| CVE-2010-5098 | typo3/cms-frontend | TYPO3 Cross-site scripting (XSS) vulnerability in the FORM content object | low | 0.0 | 2% |
| CVE-2021-24361 | location-manager (WordPress plugin) | In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate som | critical | 9.8 | 2% |
| CVE-2015-1000002 | filedownload (WordPress plugin) | Open Proxy in filedownload v1.4 wordpress plugin | high | 8.2 | 2% |
| CVE-2015-7562 | nilsteampassnet/teampass | TeamPass vulnerable to Cross-site Scripting | medium | 6.1 | 2% |
| CVE-2011-4278 | moodle/moodle | Moodle XSS In Tag Autocomplete functionality | medium | 0.0 | 2% |
| CVE-2011-4282 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2011-4286 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | medium | 0.0 | 2% |
| CVE-2011-4306 | moodle/moodle | Moodle XSS Vulnerability | medium | 0.0 | 2% |
| CVE-2014-3548 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | medium | 0.0 | 2% |
| CVE-2014-9059 | moodle/moodle | Moodle does not provide charset information in HTTP headers | medium | 0.0 | 2% |
| CVE-2018-20966 | woocommerce-jetpack (WordPress plugin) | The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature. | medium | 6.1 | 2% |
| CVE-2020-13764 | gravityforms (WordPress plugin), wp-premium/gravityforms | common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special ca | high | 7.5 | 2% |
| CVE-2021-23814 | unisharp/laravel-filemanager | Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager | medium | 6.7 | 2% |
| CVE-2017-12199 | ultimate-product-catalog (WordPress plugin) | The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue | critical | 9.8 | 2% |
| CVE-2011-4943 | impresspages/impresspages | ImpressPages CMS RCE | critical | 9.8 | 2% |
| CVE-2019-25060 | wp-graphql/wp-graphql, wpgraphql (WordPress plugin) | Improper Access Control in wp-graphql | medium | 5.3 | 2% |
| CVE-2017-18543 | invite-anyone (WordPress plugin) | The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations. | critical | 9.8 | 2% |
| CVE-2017-1000018 | phpmyadmin/phpmyadmin | phpMyAdmin DoS Vulnerability | high | 7.5 | 2% |
| CVE-2021-33557 | mantisbt/mantisbt | MantisBT allows XSS in manage_custom_field_edit_page.php | medium | 6.1 | 2% |
| CVE-2013-2080 | moodle/moodle | Moodle is vulnerable to Sensitive Information Disclosure | medium | 0.0 | 2% |
| CVE-2020-10802 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection vulnerability | high | 8.0 | 2% |
| CVE-2012-6147 | typo3/cms | Typo3 Backend API XSS Vulnerability | low | 0.0 | 2% |
| CVE-2020-20120 | topthink/thinkphp | SQL Injection in topthink/thinkphp | critical | 9.8 | 2% |