Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-4604 | your-text-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in settings/pwsettings.php in the Your Text Manager plugin 0.3.0 and earlier for WordPress allows r | medium | 4.3 | 2% |
| CVE-2014-4605 | zdstatistics (WordPress plugin) | Cross-site scripting (XSS) vulnerability in cal/test.php in the ZdStatistics (zdstats) plugin 2.0.1 and earlier for WordPress allows remote | medium | 4.3 | 2% |
| CVE-2014-4606 | zeenshare (WordPress plugin) | Cross-site scripting (XSS) vulnerability in redirect_to_zeenshare.php in the ZeenShare plugin 1.0.1 and earlier for WordPress allows remote | medium | 4.3 | 2% |
| CVE-2014-4723 | easy-banners (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2021-23803 | latte/latte | Incorrect Authorization in latte/latte | critical | 9.8 | 2% |
| CVE-2019-18834 | subscriptions (WordPress plugin) | Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript be | medium | 6.1 | 2% |
| CVE-2021-24863 | stop-bad-bots (WordPress plugin) | The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not saniti | critical | 9.8 | 2% |
| CVE-2021-24866 | wp-data-access (WordPress plugin) | The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL state | critical | 9.8 | 2% |
| CVE-2021-24951 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when | critical | 9.8 | 2% |
| CVE-2021-24562 | lifterlms (WordPress plugin) | The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an I | high | 7.5 | 2% |
| CVE-2021-21263 | illuminate/database, laravel/framework | Query Binding Exploitation | high | 7.2 | 2% |
| CVE-2018-11515 | wpforo (WordPress plugin) | The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. | critical | 9.8 | 2% |
| CVE-2020-8596 | participants-database (WordPress plugin) | participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vul | high | 7.5 | 2% |
| CVE-2014-2040 | media-file-renamer (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions | low | 2.1 | 2% |
| CVE-2023-2704 | bp-social-connect (WordPress plugin) | The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insu | critical | 9.8 | 2% |
| CVE-2016-10096 | genix/cms | GeniXCMS SQL injection vulnerability | high | 7.3 | 2% |
| CVE-2015-9407 | xpinner-lite (WordPress plugin) | The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS. | medium | 6.1 | 2% |
| CVE-2016-10992 | music-store (WordPress plugin) | The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter. | medium | 6.1 | 2% |
| CVE-2018-6465 | propertyhive (WordPress plugin) | The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-em | medium | 6.1 | 2% |
| CVE-2020-35849 | mantisbt/mantisbt | MantisBT Incorrect Authorization for bug_revision_view_page.php check | high | 7.5 | 2% |
| CVE-2017-18517 | bws-pinterest (WordPress plugin) | The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18518 | bws-smtp (WordPress plugin) | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18529 | promobar (WordPress plugin) | The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18537 | visitors-online (WordPress plugin) | The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2021-4382 | recently (WordPress plugin) | The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() | high | 8.8 | 2% |
| CVE-2019-15863 | convertplus (WordPress plugin) | The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants. | high | 7.5 | 2% |
| CVE-2021-24583 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any us | medium | 4.3 | 2% |
| CVE-2022-0709 | booking-package (WordPress plugin) | The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this | high | 7.5 | 2% |
| CVE-2021-39864 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Request Forgery (CSRF) | medium | 6.5 | 2% |
| CVE-2023-5550 | moodle/moodle | Moodle Code Injection vulnerability | medium | 6.5 | 2% |
| CVE-2013-1348 | symfony/symfony, symfony/yaml | Symphony Vulnerable to PHP Code Injection via YAML Parsing | high | 0.0 | 2% |
| CVE-2013-1397 | symfony/symfony, symfony/yaml | Symfony Arbitrary PHP code Execution | high | 0.0 | 2% |
| CVE-2017-8827 | genix/cms | GeniXCMS Arbitrary User Password Reset Vulnerability | critical | 9.1 | 2% |
| CVE-2014-3923 | video-gallery (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attacke | medium | 4.3 | 2% |
| CVE-2014-4515 | anyfont (WordPress plugin) | Cross-site scripting (XSS) vulnerability in mce_anyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attac | medium | 4.3 | 2% |
| CVE-2014-4527 | envialosimple-email-marketing-y-newsletters-gratis (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters ( | medium | 4.3 | 2% |
| CVE-2014-4543 | pay-per-media-player (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress a | medium | 4.3 | 2% |
| CVE-2014-4545 | pro-quoter (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in pq_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote att | medium | 4.3 | 2% |
| CVE-2014-4547 | rezgo-online-booking (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for | medium | 4.3 | 2% |
| CVE-2014-4568 | video-posts-webcam-recorder (WordPress plugin) | Cross-site scripting (XSS) vulnerability in posts/videowhisper/r_logout.php in the Video Posts Webcam Recorder plugin 1.55.4 and earlier for | medium | 4.3 | 2% |
| CVE-2014-4571 | vn-calendar (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote att | medium | 4.3 | 2% |
| CVE-2014-4587 | wp-guestmap-project (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP GuestMap plugin 1.8 and earlier for WordPress allow remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4589 | wp-silverlight-media-player (WordPress plugin) | Cross-site scripting (XSS) vulnerability in uploader.php in the WP Silverlight Media Player (wp-media-player) plugin 0.8 and earlier for Wor | medium | 4.3 | 2% |
| CVE-2014-4596 | snapapp (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in js/button-snapapp.php in the SnapApp plugin 1.5 and earlier for WordPress allow remot | medium | 4.3 | 2% |
| CVE-2014-4845 | bannerman (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2014-4846 | metaslider (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary | medium | 4.3 | 2% |
| CVE-2014-4847 | random-banner (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2014-4848 | blogstand-smart-banner (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers t | medium | 4.3 | 2% |
| CVE-2014-4854 | wp-contruction-mode (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2014-9570 | simple-security (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow rem | medium | 4.3 | 2% |