Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2943 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including | medium | 4.9 | 2% |
| CVE-2019-15895 | search-exclude (WordPress plugin) | search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes. | high | 7.5 | 2% |
| CVE-2020-24149 | podcast-importer-secondline (WordPress plugin) | Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podca | high | 7.5 | 2% |
| CVE-2022-2818 | cockpit-hq/cockpit | Cockpit Content Platform vulnerable to 2FA bypass | high | 8.8 | 2% |
| CVE-2023-39526 | prestashop/prestashop | PrestaShop SQL manager vulnerability | critical | 9.1 | 2% |
| CVE-2016-6623 | phpmyadmin/phpmyadmin | phpMyAdmin DoS Vulnerability | medium | 6.5 | 2% |
| CVE-2010-5296 | WordPress core | wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for th | medium | 4.9 | 2% |
| CVE-2016-2154 | moodle/moodle | Moodle allows attackers to discover hidden course names | medium | 4.3 | 2% |
| CVE-2016-2156 | moodle/moodle | Moodle provides calendar-event data without considering whether an activity is hidden | medium | 4.3 | 2% |
| CVE-2023-3342 | user-registration (WordPress plugin) | The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type v | critical | 9.9 | 2% |
| CVE-2022-3805 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in | high | 8.6 | 2% |
| CVE-2012-1207 | forkcms/forkcms | ForkCMS Directory Traversal vulnerability | medium | 0.0 | 2% |
| CVE-2023-1381 | wp-meta-seo (WordPress plugin) | The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to | high | 8.8 | 2% |
| CVE-2016-5702 | phpmyadmin/phpmyadmin | phpMyAdmin cookie-attribute injection | low | 3.7 | 2% |
| CVE-2026-40261 | composer/composer | Composer has a command injection via malicious perforce reference | high | 8.8 | 2% |
| CVE-2017-18516 | bws-linkedin (WordPress plugin) | The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18527 | pagination (WordPress plugin) | The pagination plugin before 1.0.7 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2023-2278 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_ | critical | 9.8 | 2% |
| CVE-2022-2219 | unyson (WordPress plugin) | The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | high | 7.2 | 2% |
| CVE-2025-2539 | file-away (WordPress plugin) | The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in | high | 7.5 | 2% |
| CVE-2020-24142 | video-downloader-for-tiktok (WordPress plugin) | Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafte | critical | 9.8 | 2% |
| CVE-2022-27862 | vikbooking (WordPress plugin) | Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to up | critical | 9.8 | 2% |
| CVE-2023-1273 | nd-shortcodes (WordPress plugin) | The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to incl | high | 8.8 | 2% |
| CVE-2020-10235 | froxlor/froxlor | Froxlor arbitrary code execution via the database configuration options | high | 8.8 | 2% |
| CVE-2020-25830 | mantisbt/mantisbt | MantisBT HTML Injection vulnerability | medium | 4.8 | 2% |
| CVE-2021-24319 | bello (WordPress plugin) | The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back | medium | 5.4 | 2% |
| CVE-2015-5151 | slider-revolution (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject a | medium | 4.3 | 2% |
| CVE-2026-53932 | wnx/laravel-backup-restore | laravel-backup-restore has an OS Command Injection during database restore | high | 8.0 | 2% |
| CVE-2016-10928 | onelogin-saml-sso (WordPress plugin) | The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users. | high | 7.5 | 2% |
| CVE-2021-24695 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or auth | high | 7.5 | 2% |
| CVE-2022-1008 | one-click-demo-import (WordPress plugin) | The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to | high | 7.2 | 2% |
| CVE-2021-24252 | event-banner (WordPress plugin) | The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, su | high | 7.2 | 2% |
| CVE-2016-7570 | drupal/core, drupal/drupal | Drupal Users without "Administer comments" can set comment visibility on nodes they can edit | medium | 4.3 | 2% |
| CVE-2019-14366 | wp-slacksync (WordPress plugin) | WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about | high | 7.5 | 2% |
| CVE-2020-9392 | pricing-table-by-supsystic (WordPress plugin) | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the Imp | high | 7.3 | 2% |
| CVE-2011-2718 | phpmyadmin/phpmyadmin | phpMyAdmin Directory Traversal Vulnerability | medium | 0.0 | 2% |
| CVE-2012-0796 | phpmailer/phpmailer | PHPMailer vulnerable to email header injection | high | 0.0 | 2% |
| CVE-2020-7109 | elementor (WordPress plugin) | The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template. | critical | 9.8 | 2% |
| CVE-2012-4422 | WordPress core | wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges b | low | 3.5 | 2% |
| CVE-2020-35128 | mautic/core | Mautic stored Cross-site Scripting (XSS) | critical | 9.0 | 2% |
| CVE-2011-4289 | moodle/moodle | Moodle does not recogniz configuration setting that makes e-mail addresses visible only to course members | medium | 0.0 | 2% |
| CVE-2014-0124 | moodle/moodle | Moodle allows attackers to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2014-7831 | moodle/moodle | Moodle exposes hidden grades to students | medium | 0.0 | 2% |
| CVE-2014-7833 | moodle/moodle | Moodle allows attackers to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2014-7834 | moodle/moodle | Moodle does not verify group permissions | medium | 0.0 | 2% |
| CVE-2015-0211 | moodle/moodle | Moodle allows attackers to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2015-0215 | moodle/moodle | Moodle allows attackers to obtain sensitive calendar-event information | medium | 0.0 | 2% |
| CVE-2015-2266 | moodle/moodle | Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information | medium | 0.0 | 2% |
| CVE-2015-3180 | moodle/moodle | Moodle allows attackers to obtain sensitive course-structure information | medium | 0.0 | 2% |
| CVE-2020-24146 | cm-download-manager (WordPress plugin) | Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitr | high | 8.1 | 2% |