Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-9064 | WordPress core | In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is | high | 8.8 | 2% |
| CVE-2021-24182 | tutor-lms (WordPress plugin) | The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before | medium | 6.5 | 2% |
| CVE-2021-24183 | tutor-lms (WordPress plugin) | The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 | medium | 6.5 | 2% |
| CVE-2012-6633 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbi | medium | 4.3 | 2% |
| CVE-2018-1137 | moodle/moodle | Moodle Portfolio script allows instantiation of class chosen by user | high | 8.1 | 2% |
| CVE-2020-24408 | magento/community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2025-2221 | wpcom-member (WordPress plugin) | The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and in | high | 7.5 | 2% |
| CVE-2023-0099 | simple-urls (WordPress plugin) | The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading | medium | 6.1 | 2% |
| CVE-2014-5324 | n-media-file-uploader (WordPress plugin) | Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to exe | medium | 6.5 | 2% |
| CVE-2017-18514 | simple-login-log (WordPress plugin) | The simple-login-log plugin before 1.1.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2023-2688 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and includ | medium | 4.9 | 2% |
| CVE-2015-9395 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action. | high | 8.8 | 2% |
| CVE-2015-9348 | sell-downloads (WordPress plugin) | The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs. | high | 7.5 | 2% |
| CVE-2022-2945 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5 | medium | 4.9 | 2% |
| CVE-2021-23592 | topthink/framework | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | 2% |
| CVE-2021-21359 | typo3/cms, typo3/cms-core | Denial of Service in Page Error Handling | medium | 5.9 | 2% |
| CVE-2023-22622 | WordPress core | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the so | medium | 5.3 | 2% |
| CVE-2020-9280 | silverstripe/assets, silverstripe/framework, silverstripe/userforms | SilverStripe Folders migrated from 3.x may be unsafe to upload to | high | 7.5 | 2% |
| CVE-2020-12074 | import-export-wordpress-users (WordPress plugin) | The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts | high | 8.8 | 2% |
| CVE-2015-9399 | wp-stats-dashboard (WordPress plugin) | The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection. | high | 7.2 | 2% |
| CVE-2022-2437 | feed-them-social (WordPress plugin) | The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the ' | critical | 9.8 | 2% |
| CVE-2018-21011 | charitable (WordPress plugin) | The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details. | high | 7.5 | 2% |
| CVE-2021-43996 | facade/ignition | Incorrect Access Control in Ignition | critical | 9.8 | 2% |
| CVE-2019-1000001 | nilsteampassnet/teampass | TeamPass Storing Passwords in a Recoverable Format vulnerability | critical | 9.8 | 2% |
| CVE-2016-10948 | post-indexer (WordPress plugin) | The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function. | high | 8.1 | 2% |
| CVE-2014-9508 | typo3/cms | Typo3 Open Redirect In Frontend Rendering | medium | 0.0 | 2% |
| CVE-2021-24409 | prismatic (WordPress plugin) | The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a re | medium | 6.1 | 2% |
| CVE-2021-24430 | speed-booster-pack (WordPress plugin) | The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_in | high | 7.2 | 2% |
| CVE-2020-28034 | WordPress core | WordPress before 5.5.2 allows XSS associated with global variables. | medium | 6.1 | 2% |
| CVE-2014-0215 | moodle/moodle | Moodle Reveals Student Information Meant To Be Anonymous | medium | 0.0 | 2% |
| CVE-2023-2706 | mobile-login-woocommerce (WordPress plugin) | The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when gen | high | 8.1 | 2% |
| CVE-2019-14793 | meta-box (WordPress plugin) | The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file atta | medium | 6.5 | 2% |
| CVE-2010-1615 | moodle/moodle | Moodle vulnerable to SQL injection | high | 0.0 | 2% |
| CVE-2020-36718 | ninja-gdpr-compliance (WordPress plugin) | The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deseri | critical | 9.8 | 2% |
| CVE-2017-1002025 | add-edit-delete-listing-for-member-module (WordPress plugin) | Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input vi | high | 7.2 | 2% |
| CVE-2016-9452 | drupal/core, drupal/drupal | Drupal Denial of service via transliterate mechanism | medium | 6.5 | 2% |
| CVE-2018-9861 | drupal/core, drupal/drupal | CKEditor, a third-party JavaScript library included in Drupal core, has [fixed a cross-site scripting (XSS) vulnerabilit | medium | 6.1 | 2% |
| CVE-2026-25892 | vrana/adminer | Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint | high | 7.5 | 2% |
| CVE-2022-0150 | wp-accessibility-helper (WordPress plugin) | The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its | medium | 6.1 | 2% |
| CVE-2022-1953 | product-configurator-for-woocommerce (WordPress plugin) | The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX ac | critical | 9.1 | 2% |
| CVE-2022-0248 | contact-form-submissions (WordPress plugin) | The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before ou | medium | 6.1 | 2% |
| CVE-2014-3545 | moodle/moodle | Moodle remote code execution via quiz questions | medium | 0.0 | 2% |
| CVE-2021-4225 | sp-project-\&-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plu | high | 8.8 | 2% |
| CVE-2022-1463 | booking-calendar (WordPress plugin) | The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, a | high | 8.8 | 2% |
| CVE-2023-1208 | http-headers (WordPress plugin) | This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution | high | 7.2 | 2% |
| CVE-2016-7572 | drupal/core, drupal/drupal | Drupal Unprivileged access to config export | medium | 4.3 | 2% |
| CVE-2021-23405 | pimcore/pimcore | SQL injection in pimcore/pimcore | high | 8.8 | 2% |
| CVE-2021-24916 | qubely (WordPress plugin) | The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_fo | high | 7.5 | 2% |
| CVE-2016-6612 | phpmyadmin/phpmyadmin | phpMyAdmin Local file exposure | medium | 6.5 | 2% |
| CVE-2019-8151 | magento/community-edition, magento/product-community-edition | Magento Server-Side Request Forgery (SSRF) | high | 7.2 | 2% |