Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-34257 | wpanel/wpanel4-cms | Unrestricted Upload of File with Dangerous Type in WPanel 4 | high | 8.8 | 2% |
| CVE-2021-24638 | omgf (WordPress plugin) | The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users | critical | 9.1 | 2% |
| CVE-2024-29686 | wintercms/winter | Winter CMS Server-Side Template Injection (SSTI) vulnerability | high | 8.8 | 2% |
| CVE-2024-12365 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_ | high | 8.5 | 2% |
| CVE-2019-10673 | ultimate-member (WordPress plugin) | A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to b | high | 8.8 | 2% |
| CVE-2013-1830 | moodle/moodle | Moodle does not enforce the forceloginforprofiles setting | medium | 0.0 | 2% |
| CVE-2012-6719 | sharebar (WordPress plugin) | The sharebar plugin before 1.2.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9313 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element. | critical | 9.8 | 2% |
| CVE-2015-9315 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.1 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2016-10889 | nextgen-gallery (WordPress plugin) | The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name. | critical | 9.8 | 2% |
| CVE-2016-10916 | appointment-booking-calendar (WordPress plugin) | The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319. | critical | 9.8 | 2% |
| CVE-2016-10921 | gallery-photo-gallery (WordPress plugin) | The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2019-1010104 | quick-chat (WordPress plugin) | TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The compone | critical | 9.8 | 2% |
| CVE-2019-14801 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. | critical | 9.8 | 2% |
| CVE-2021-24948 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJ | high | 7.5 | 2% |
| CVE-2010-5295 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary | medium | 4.3 | 2% |
| CVE-2021-24272 | fitness-calculators (WordPress plugin) | The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was | medium | 4.3 | 2% |
| CVE-2017-18548 | note-press (WordPress plugin) | The note-press plugin before 0.1.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2010-1618 | apereo/phpcas, moodle/moodle | phpCAS client library and Moodle Cross-site Scripting vulnerability | medium | 0.0 | 2% |
| CVE-2024-8673 | z-downloads (WordPress plugin) | The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malic | critical | 9.1 | 2% |
| CVE-2021-24546 | editorskit (WordPress plugin) | The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the C | high | 8.8 | 2% |
| CVE-2011-4955 | bsuite (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attacke | medium | 6.1 | 2% |
| CVE-2010-1613 | moodle/moodle | Moodle Session Fixation vulnerability | medium | 0.0 | 2% |
| CVE-2022-0533 | ditty-news-ticker (WordPress plugin) | The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability. | medium | 6.1 | 2% |
| CVE-2018-10752 | tagregator (WordPress plugin) | The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action. | medium | 4.8 | 2% |
| CVE-2019-16218 | WordPress core | WordPress before 5.2.3 allows XSS in stored comments. | medium | 6.1 | 2% |
| CVE-2021-21026 | magento/community-edition, magento/project-community-edition | Magento improper authorization vulnerability in the integrations module | medium | 5.3 | 2% |
| CVE-2013-6289 | apache-solr-for-typo3/solr | Apache Solr for TYPO3 (solr) extension is vulnerable to Cross-site scripting (XSS) | medium | 4.3 | 2% |
| CVE-2015-5482 | gd-bbpress-attachments (WordPress plugin) | Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and | medium | 4.0 | 2% |
| CVE-2019-9573 | hrm (WordPress plugin) | The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications. | high | 7.5 | 2% |
| CVE-2015-9312 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element. | medium | 6.1 | 2% |
| CVE-2016-4833 | nofollow-links (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 2% |
| CVE-2020-36474 | vanilla/safecurl | SafeCurl before 0.9.2 has a DNS rebinding vulnerability. | critical | 9.8 | 2% |
| CVE-2010-2574 | mantisbt/mantisbt | MantisBT Cross-site Scripting vulnerability | low | 0.0 | 2% |
| CVE-2015-9333 | cforms2 (WordPress plugin) | The cforms2 plugin before 14.6.10 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2020-12477 | nilsteampassnet/teampass | Incorrect Authorization in TeamPass | high | 7.5 | 2% |
| CVE-2022-2442 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter | high | 7.2 | 2% |
| CVE-2021-4354 | pwa-for-wp-\&-amp (WordPress plugin) | The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_ | high | 8.8 | 2% |
| CVE-2021-36037 | magento/community-edition, magento/project-community-edition | Magento is affected by an improper authorization vulnerability | medium | 6.5 | 2% |
| CVE-2021-29454 | smarty/smarty | Sandbox Escape by math function in smarty | high | 8.1 | 2% |
| CVE-2017-14766 | simple-student-result (WordPress plugin) | The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() fu | high | 7.5 | 2% |
| CVE-2021-38299 | web-auth/webauthn-framework | Improper Access Control in Webauthn Framework | critical | 9.8 | 2% |
| CVE-2024-6420 | hide-my-wp-ghost (WordPress plugin) | The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, a | high | 8.6 | 2% |
| CVE-2020-6164 | silverstripe/cms, silverstripe/framework | Silverstripe CMS information disclosure | high | 7.5 | 2% |
| CVE-2021-24545 | wp-html-author-bio (WordPress plugin) | The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious | medium | 5.4 | 2% |
| CVE-2017-18573 | simple-login-log (WordPress plugin) | The simple-login-log plugin before 1.1.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2024-47051 | mautic/core | Mautic allows Remote Code Execution and File Deletion in Asset Uploads | critical | 9.1 | 2% |
| CVE-2022-0970 | getgrav/grav | Stored Cross-site Scripting in grav | high | 7.1 | 2% |
| CVE-2023-1877 | microweber/microweber | Microweber vulnerable to command injection | medium | 6.1 | 2% |
| CVE-2016-6622 | phpmyadmin/phpmyadmin | phpMyAdmin DoS Vulnerability | medium | 5.9 | 2% |