Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-4847 | random-banner (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2014-4848 | blogstand-smart-banner (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers t | medium | 4.3 | 2% |
| CVE-2014-4854 | wp-contruction-mode (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2014-9570 | simple-security (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow rem | medium | 4.3 | 2% |
| CVE-2022-2434 | string-locator (WordPress plugin) | The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versi | high | 8.8 | 2% |
| CVE-2014-7217 | phpmyadmin/phpmyadmin | phpMyAdmin cross-site scripting Vulnerability via ENUM value | low | 0.0 | 2% |
| CVE-2021-41279 | baserproject/basercms | Potential Zip Slip Vulnerability in baserCMS | high | 7.7 | 2% |
| CVE-2022-34259 | magento/community-edition | Magento Improper Access Control vulnerability | medium | 5.3 | 2% |
| CVE-2020-36727 | newsletter-manager (WordPress plugin) | The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due t | critical | 9.8 | 2% |
| CVE-2016-2155 | moodle/moodle | Moodle allows attackers to modify "Exclude grade" settings | medium | 4.3 | 2% |
| CVE-2011-1028 | smarty/smarty | Smarty3 Arbitrary PHP Code Execution | critical | 9.8 | 2% |
| CVE-2022-36104 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Denial of Service in Page Error Handling | medium | 5.9 | 2% |
| CVE-2010-5097 | typo3/cms-frontend | TYPO3 Cross-site scripting (XSS) vulnerability in the click enlarge functionality | low | 0.0 | 2% |
| CVE-2012-1606 | typo3/cms | Typo3 Backend XSS Vulnerabilities | low | 0.0 | 2% |
| CVE-2020-24147 | wp-smart-import (WordPress plugin) | Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field. | critical | 9.1 | 2% |
| CVE-2019-16781 | WordPress core | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, whi | medium | 5.8 | 2% |
| CVE-2019-14789 | custom-404-pro (WordPress plugin) | The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter. | medium | 6.1 | 2% |
| CVE-2021-4084 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.1 | 2% |
| CVE-2015-2267 | moodle/moodle | Moodle allows attackers to extract archives to arbitrary directories | medium | 0.0 | 2% |
| CVE-2024-9765 | ekc-tournament-manager (WordPress plugin) | The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress director | medium | 6.5 | 2% |
| CVE-2021-25007 | molie-instructure-canvas-linking-tool (WordPress plugin) | The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Inje | critical | 9.8 | 2% |
| CVE-2021-25070 | block-and-stop-bad-bots (WordPress plugin) | The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to r | critical | 9.8 | 2% |
| CVE-2022-1014 | wp-contacts-manager (WordPress plugin) | The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in | critical | 9.8 | 2% |
| CVE-2021-24303 | official-website-mini-program (WordPress plugin) | The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in | high | 8.8 | 2% |
| CVE-2019-9575 | quiz-master-next (WordPress plugin) | The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS. | medium | 6.1 | 2% |
| CVE-2020-36723 | listingpro (WordPress plugin) | The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the | medium | 5.3 | 2% |
| CVE-2013-2695 | wp-symposium (WordPress plugin) | Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium plugin before 13.04 for WordPress allows remote attackers to inje | medium | 4.3 | 2% |
| CVE-2022-0771 | sitesupercharger (WordPress plugin) | The SiteSuperCharger WordPress plugin before 5.2.0 does not validate, sanitise and escape various user inputs before using them in SQL state | critical | 9.8 | 2% |
| CVE-2020-25699 | moodle/moodle | Privilage Escalation in moodle | high | 7.5 | 2% |
| CVE-2020-7104 | chained-quiz (WordPress plugin) | The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter. | medium | 6.1 | 2% |
| CVE-2026-55182 | librenms/librenms | LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module | high | 0.0 | 2% |
| CVE-2021-21357 | typo3/cms, typo3/cms-core, typo3/cms-form | Broken Access Control in Form Framework | high | 8.3 | 2% |
| CVE-2017-6919 | drupal/core, drupal/drupal | Drupal access control bypass vulnerability | high | 7.5 | 2% |
| CVE-2017-6927 | drupal/core, drupal/drupal | Drupal cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2021-21023 | magento/community-edition, magento/project-community-edition | Magento stored cross-site scripting vulnerability in the admin console | medium | 4.8 | 2% |
| CVE-2020-36713 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestric | critical | 9.8 | 2% |
| CVE-2014-4986 | phpmyadmin/phpmyadmin | phpMyAdmin cross-site scripting Vulnerability in Table or Column Names | low | 0.0 | 2% |
| CVE-2021-24893 | stars-rating (WordPress plugin) | The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial | high | 7.5 | 2% |
| CVE-2013-1831 | moodle/moodle | Moodle reveals absolute path in exception message | medium | 0.0 | 2% |
| CVE-2019-10668 | librenms/librenms | Missing Authentication for Critical Function in LibreNMS | critical | 9.1 | 2% |
| CVE-2020-12104 | wp-advanced-search (WordPress plugin) | The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql fi | high | 8.8 | 2% |
| CVE-2011-3130 | WordPress core | wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy quer | high | 7.5 | 2% |
| CVE-2021-24239 | pie-register (WordPress plugin) | The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not | medium | 6.1 | 2% |
| CVE-2018-7260 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature | medium | 5.4 | 2% |
| CVE-2013-6280 | social-sharing-toolkit (WordPress plugin) | Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbit | medium | 4.3 | 2% |
| CVE-2023-0265 | uvdesk/community-skeleton | Uvdesk remote code execution vulnerability | high | 8.8 | 2% |
| CVE-2013-3263 | wp-ultimate-email-marketer-plugin (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow | medium | 4.3 | 2% |
| CVE-2014-9443 | relevanssi (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web | medium | 4.3 | 2% |
| CVE-2021-25994 | userfrosting/userfrosting | Injection in UserFrosting | high | 8.8 | 2% |
| CVE-2021-24492 | handsome-testimonials-\&-reviews (WordPress plugin) | The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authent | high | 8.8 | 2% |