Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-21031 | magento/community-edition, magento/project-community-edition | Magento Insufficient Session Expiration | medium | 5.6 | 2% |
| CVE-2018-11495 | opencart/opencart | OpenCart Path Traversal | medium | 4.9 | 2% |
| CVE-2007-4190 | joomla/application | Joomla! vulnerable to CRLF injection | medium | 0.0 | 2% |
| CVE-2024-39401 | magento/community-edition, magento/project-community-edition | Magento OS Command ('OS Command Injection') vulnerability | high | 8.4 | 2% |
| CVE-2024-39402 | magento/community-edition, magento/project-community-edition | Magento OS Command ('OS Command Injection') vulnerability | high | 8.4 | 2% |
| CVE-2021-24910 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available | medium | 6.1 | 2% |
| CVE-2017-2551 | backwpup (WordPress plugin) | Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download. | high | 7.5 | 2% |
| CVE-2020-35936 | post-grid (WordPress plugin), team-showcase (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers t | high | 7.5 | 2% |
| CVE-2020-35937 | post-grid (WordPress plugin), team-showcase (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attack | high | 7.5 | 2% |
| CVE-2022-1165 | blackhole-for-bad-bots (WordPress plugin) | The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of | critical | 9.1 | 2% |
| CVE-2019-19211 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2010-1614 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2010-1619 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2019-15649 | insert-or-embed-articulate-content-into-wordpress (WordPress plugin) | The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload. | high | 8.8 | 2% |
| CVE-2023-6654 | phpems/phpems | PHPEMS Deserialization of Untrusted Data vulnerability | medium | 6.3 | 2% |
| CVE-2022-24664 | php-everywhere (WordPress plugin) | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by a | critical | 9.9 | 2% |
| CVE-2014-8809 | wp-symposium (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject a | medium | 4.3 | 2% |
| CVE-2013-1834 | moodle/moodle | Moodle allows remote authenticated users to reassign notes | medium | 0.0 | 2% |
| CVE-2019-17599 | quiz-master-next (WordPress plugin) | The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact i | medium | 6.1 | 2% |
| CVE-2023-0789 | thorsten/phpmyfaq | Command Injection in thorsten/phpmyfaq | critical | 9.8 | 2% |
| CVE-2019-7299 | wp-support-plus-responsive-ticket-system (WordPress plugin) | A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1 | medium | 6.1 | 2% |
| CVE-2021-21027 | magento/community-edition, magento/project-community-edition | Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API | medium | 4.3 | 2% |
| CVE-2018-5387 | gogentooss/samlbase | Wizkunde SAMLBase SAML Bypass | high | 7.5 | 2% |
| CVE-2018-18546 | topthink/framework | ThinkPHP SQLi Vulnerability | critical | 9.8 | 2% |
| CVE-2024-9659 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.8 | 2% |
| CVE-2022-0258 | pimcore/pimcore | pimcore is vulnerable to SQL Injection | high | 8.3 | 2% |
| CVE-2017-12873 | simplesamlphp/simplesamlphp | Incorrect persistent NameID generation in SimpleSAMLphp | critical | 9.8 | 2% |
| CVE-2019-9914 | yop-poll (WordPress plugin) | The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS. | medium | 6.1 | 2% |
| CVE-2015-1393 | photo-gallery (WordPress plugin) | SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary S | medium | 6.5 | 2% |
| CVE-2021-24875 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting i | medium | 6.1 | 2% |
| CVE-2021-24979 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin | medium | 6.1 | 2% |
| CVE-2022-2796 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) | medium | 6.7 | 2% |
| CVE-2017-18502 | subscriber (WordPress plugin) | The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18505 | twitter-plugin (WordPress plugin) | The twitter-plugin plugin before 2.55 for WordPress has XSS. | medium | 6.1 | 2% |
| CVE-2021-25085 | woocommerce-products-filter (WordPress plugin) | The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leadi | medium | 6.1 | 2% |
| CVE-2014-4514 | alipay (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress a | medium | 4.3 | 2% |
| CVE-2015-1582 | spider-facebook (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to | medium | 4.3 | 2% |
| CVE-2006-1263 | WordPress core | Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2016-10926 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php. | critical | 10.0 | 2% |
| CVE-2016-10927 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php. | critical | 10.0 | 2% |
| CVE-2013-7400 | directmailteam/direct-mail | The Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive information | high | 7.5 | 2% |
| CVE-2023-2859 | nilsteampassnet/teampass | Code injection in nilsteampassnet/teampass | high | 7.1 | 2% |
| CVE-2007-3543 | WordPress core | Unrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3 allows remote authenticated users to upload a | medium | 6.0 | 2% |
| CVE-2012-6627 | newsletter-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remo | medium | 4.3 | 2% |
| CVE-2012-6630 | media-library-categories (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inj | medium | 4.3 | 2% |
| CVE-2012-3530 | typo3/cms | Typo3 API XSS Vulnerability | medium | 0.0 | 2% |
| CVE-2017-5346 | genix/cms | GeniXCMS SQL injection vulnerability | high | 7.2 | 2% |
| CVE-2018-17866 | ultimate-member (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membershi | medium | 6.1 | 2% |
| CVE-2023-0169 | zoho-forms (WordPress plugin) | The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a | medium | 5.4 | 2% |
| CVE-2010-5104 | typo3/cms-core | TYPO3 Sensitive Information Disclosure via escapeStrForLike method | medium | 0.0 | 2% |