Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-8156 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SSRF vulnerability | high | 7.2 | 2% |
| CVE-2021-24727 | stop-bad-bots (WordPress plugin) | The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard p | high | 8.8 | 2% |
| CVE-2021-24728 | paid-member-subscriptions (WordPress plugin) | The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its orde | high | 8.8 | 2% |
| CVE-2021-24216 | one-stop-wp-migration (WordPress plugin) | The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload | high | 7.2 | 2% |
| CVE-2014-4726 | wysija-newsletters (WordPress plugin) | Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and atta | high | 7.5 | 2% |
| CVE-2016-2559 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site scripting (XSS) vulnerability in SQL parser | medium | 5.4 | 2% |
| CVE-2014-7832 | moodle/moodle | Moodle allows attackers to bypass the mod/lti:view capability requirement | medium | 0.0 | 2% |
| CVE-2014-7846 | moodle/moodle | Moodle does not consider the moodle/tag:edit capability before adding a tag | medium | 0.0 | 2% |
| CVE-2022-29712 | librenms/librenms | Command injection in librenms | high | 0.0 | 2% |
| CVE-2020-22452 | phpmyadmin/phpmyadmin | phpmyadmin contains SQL Injection vulnerability | critical | 9.8 | 2% |
| CVE-2017-1002026 | event-espresso-free (WordPress plugin) | Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input v | high | 8.8 | 2% |
| CVE-2020-29470 | opencart/opencart | OpenCart Cross-site Scripting (XSS) in the Subject field of mail. | medium | 4.8 | 2% |
| CVE-2023-2023 | custom-404-pro (WordPress plugin) | The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross- | medium | 6.1 | 2% |
| CVE-2013-1835 | moodle/moodle | Moodle's login_as feature leaks information from external repositories | low | 0.0 | 2% |
| CVE-2026-46364 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha | critical | 9.8 | 2% |
| CVE-2014-0129 | moodle/moodle | Moodle allows attackers to modify the visibility of a badge | medium | 0.0 | 2% |
| CVE-2016-2158 | moodle/moodle | Moodle allows attackers to obtain sensitive category-detail information | medium | 4.3 | 2% |
| CVE-2023-30839 | prestashop/prestashop | SQL filter bypass leading to arbitrary write requests using "SQL Manager" | critical | 9.9 | 2% |
| CVE-2021-39317 | access-demo-importer (WordPress plugin), accesspress-basic (WordPress plugin), accesspress-lite (WordPress plugin) +40 more | A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offl | high | 8.8 | 2% |
| CVE-2020-10568 | sitepress-multilingual-cms (WordPress plugin) | The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code ex | high | 8.8 | 2% |
| CVE-2012-5657 | zendframework/zendframework1 | Zend Framework XXE Vulnerability | medium | 0.0 | 2% |
| CVE-2021-24949 | the-plus-addons-for-elementor (WordPress plugin) | The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option | critical | 9.8 | 2% |
| CVE-2020-25827 | mediawiki/core | OATHAuth extension in MediaWiki is not implementing rate limit | high | 7.5 | 2% |
| CVE-2022-0541 | flo-launch (WordPress plugin) | The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate | critical | 9.8 | 2% |
| CVE-2016-10973 | brafton (WordPress plugin) | The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage | medium | 6.1 | 2% |
| CVE-2020-24402 | magento/community-edition, magento/project-community-edition | Magento incorrect permissions vulnerability in the Integrations component | medium | 4.9 | 2% |
| CVE-2022-1933 | collect-and-deliver-interface-for-woocommerce (WordPress plugin) | The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action ( | medium | 6.1 | 2% |
| CVE-2018-25357 | dolibarr/dolibarr | Dolibarr ERP CRM contains a remote code evaluation vulnerability | critical | 9.8 | 2% |
| CVE-2019-12570 | server-status-by-hostname\/ip (WordPress plugin) | A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to | high | 8.8 | 2% |
| CVE-2017-6570 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6571 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6572 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6573 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6574 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6575 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6576 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6577 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6578 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2023-38490 | getkirby/cms | XML External Entity (XXE) vulnerability in the XML data handler | medium | 6.8 | 2% |
| CVE-2021-36026 | magento/community-edition, magento/project-community-edition | Magento stored cross-site scripting vulnerability in the customer address upload feature | medium | 0.0 | 2% |
| CVE-2021-3692 | yiisoft/yii2-dev | Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev | medium | 5.3 | 2% |
| CVE-2015-0214 | moodle/moodle | Moodle allows attackers to bypass a messaging-disabled setting | medium | 0.0 | 2% |
| CVE-2015-2271 | moodle/moodle | Moodle does not consider the moodle/tag:flag capability | medium | 0.0 | 2% |
| CVE-2015-2272 | moodle/moodle | Moodle allows attackers to bypass a forced-password-change requirement | medium | 0.0 | 2% |
| CVE-2015-3181 | moodle/moodle | Moodle allows attackers to bypass file-management restrictions | medium | 0.0 | 2% |
| CVE-2020-15246 | october/cms | Local File Inclusion by unauthenticated users | high | 7.5 | 2% |
| CVE-2019-16317 | pimcore/pimcore | Pimcore RCE via PHAR upload | high | 8.8 | 2% |
| CVE-2018-15605 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting (XSS) in the import dialog | medium | 6.1 | 2% |
| CVE-2019-16780 | WordPress core | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is | medium | 5.8 | 2% |
| CVE-2018-6519 | simplesamlphp/saml2 | SimpleSAMLphp SAML2 library Regular Expression Denial of Service vulnerability | high | 7.5 | 2% |