Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2011-4627 | typo3/cms | Typo3 Information Disclosure | medium | 6.5 | 1% |
| CVE-2011-4900 | typo3/cms | Typo3 Information Disclosure | medium | 6.5 | 1% |
| CVE-2023-37260 | league/oauth2-server | league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase | high | 8.2 | 1% |
| CVE-2019-7888 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Information Disclosure | medium | 6.5 | 1% |
| CVE-2021-39203 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | medium | 6.8 | 1% |
| CVE-2023-5254 | chatbot (WordPress plugin) | The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_cha | medium | 5.3 | 1% |
| CVE-2019-7852 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Path Disclosure | medium | 5.3 | 1% |
| CVE-2020-5301 | simplesamlphp/simplesamlphp | Information disclosure of source code in SimpleSAMLphp | low | 3.0 | 1% |
| CVE-2022-40194 | customer-reviews-woocommerce (WordPress plugin) | Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress | medium | 5.3 | 1% |
| CVE-2017-7531 | moodle/moodle | Moodle Information Disclosure | medium | 4.3 | 1% |
| CVE-2023-0557 | contentstudio (WordPress plugin) | The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could a | high | 7.5 | 1% |
| CVE-2026-42878 | facturascripts/facturascripts | FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint | medium | 5.3 | 1% |
| CVE-2021-25110 | futurio-extra (WordPress plugin) | The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address. | medium | 4.3 | 1% |
| CVE-2021-24164 | ninja-forms (WordPress plugin) | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ | medium | 4.3 | 1% |
| CVE-2023-5576 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and includi | high | 8.0 | 1% |
| CVE-2021-32720 | sylius/sylius | List of order ids, number, items total and token value exposed for unauthorized uses via new API | medium | 5.3 | 1% |
| CVE-2017-12870 | simplesamlphp/simplesamlphp | SimpleSAMLphp Unauthenticated encryption in CBC mode | medium | 5.9 | 1% |
| CVE-2022-2939 | wp-cerber (WordPress plugin) | The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes use | medium | 5.3 | 1% |
| CVE-2014-8607 | xcloner (WordPress plugin) | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows loca | low | 2.1 | 1% |
| CVE-2014-125093 | ad-blocking-detector (WordPress plugin) | A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability aff | medium | 4.3 | 1% |
| CVE-2021-40695 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2023-5256 | drupal/core | In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause se | critical | 0.0 | 1% |
| CVE-2023-48122 | microweber/microweber | Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method | high | 7.5 | 1% |
| CVE-2023-2446 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and includ | medium | 6.5 | 1% |
| CVE-2012-3529 | typo3/cms | Typo3 Backend Configuration XSS Vulnerability | low | 0.0 | 1% |
| CVE-2024-5657 | born05/craft-twofactorauthentication | Password hash exposed in CraftCMS two factor authentication plugin | low | 3.7 | 1% |
| CVE-2023-3553 | nilsteampassnet/teampass | TeamPass information exposure vulnerability | high | 7.5 | 1% |
| CVE-2022-24742 | sylius/sylius | Sensitive Information Exposure in Sylius | medium | 5.0 | 1% |
| CVE-2023-5359 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google O | low | 3.7 | 1% |
| CVE-2024-2106 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versio | medium | 5.3 | 1% |
| CVE-2026-1194 | mineadmin/mineadmin | MineAdmin May Expose Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2023-6777 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and inc | medium | 5.3 | 1% |
| CVE-2024-4596 | kimai/kimai | Kimai information disclosure vulnerability | low | 3.7 | 1% |
| CVE-2022-34867 | wp-libre-form (WordPress plugin), libreform/libreform | Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and | high | 7.3 | 1% |
| CVE-2021-32472 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2023-0814 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the | medium | 6.5 | 1% |
| CVE-2021-24661 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor | medium | 4.3 | 1% |
| CVE-2023-4917 | leyka (WordPress plugin) | The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_ | medium | 5.3 | 1% |
| CVE-2013-10030 | wordpress-exit-box-lite (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue | medium | 4.3 | 1% |
| CVE-2023-4796 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and i | medium | 4.3 | 1% |
| CVE-2023-1402 | moodle/moodle | Moodle may display roles to users who don't have access to them | medium | 4.3 | 1% |
| CVE-2023-28336 | moodle/moodle | Moodle may allow teachers to access the names of users they could not otherwise access | medium | 4.3 | 1% |
| CVE-2023-44394 | mantisbt/mantisbt | MantisBT may disclose project names to unauthorized users | medium | 4.3 | 1% |
| CVE-2021-32477 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2022-42883 | quiz-and-survey-master (WordPress plugin) | Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 5.3 | 1% |
| CVE-2012-10016 | simple-download-button-shortcode (WordPress plugin) | A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an | medium | 4.3 | 1% |
| CVE-2022-47410 | fixpunkt/fp-newsletter | "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data | high | 7.5 | 1% |
| CVE-2022-47411 | fixpunkt/fp-newsletter | "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data | high | 7.5 | 1% |
| CVE-2013-10024 | exit-strategy (WordPress plugin) | A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an | low | 3.5 | 1% |
| CVE-2023-29287 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Information Exposure | medium | 5.3 | 1% |