Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4693 | user-verification (WordPress plugin) | The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we onl | critical | 9.8 | 2% |
| CVE-2021-3980 | elgg/elgg | Information exposure in elgg | high | 7.5 | 2% |
| CVE-2016-10939 | xtremelocator (WordPress plugin) | The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter. | high | 7.2 | 2% |
| CVE-2023-4238 | prevent-files-\/-folders-access (WordPress plugin) | The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to uplo | high | 7.2 | 2% |
| CVE-2018-18478 | librenms/librenms | LibreNMS XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2022-2433 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeate | high | 7.5 | 2% |
| CVE-2023-4314 | wpdatatables (WordPress plugin) | The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This | high | 7.2 | 2% |
| CVE-2014-5183 | simple-retail-menus (WordPress plugin) | SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allow | medium | 6.5 | 2% |
| CVE-2017-12977 | photo-gallery (WordPress plugin) | The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related | high | 7.2 | 2% |
| CVE-2024-1234 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up t | medium | 6.4 | 2% |
| CVE-2021-24454 | yop-poll (WordPress plugin) | In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the | medium | 6.1 | 2% |
| CVE-2020-13487 | bbpress (WordPress plugin), bbpress/bbpress | The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/e | medium | 4.8 | 2% |
| CVE-2021-20187 | moodle/moodle | Moodle Arbitrary PHP code execution by site admins via Shibboleth configuration | high | 7.2 | 2% |
| CVE-2019-17674 | WordPress core | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. | medium | 5.4 | 2% |
| CVE-2016-3162 | drupal/core, drupal/drupal | Drupal File upload access bypass and denial of service | high | 8.1 | 2% |
| CVE-2010-3671 | typo3/cms-install | TYPO3 is vulnerable to Session Fixation | medium | 6.5 | 2% |
| CVE-2022-0214 | custom-popup-builder (WordPress plugin) | The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthentica | high | 7.5 | 2% |
| CVE-2017-8388 | genix/cms | GeniXCMS Mailbox validation logic vulnerability | medium | 5.3 | 2% |
| CVE-2015-2195 | wp-media-cleaner (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbi | medium | 4.3 | 2% |
| CVE-2014-3123 | nextcellent-gallery-nextgen-legacy (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows re | low | 2.1 | 2% |
| CVE-2009-5054 | smarty/smarty | Smarty Does Not Consider Umask Values When Setting Permissions | medium | 0.0 | 2% |
| CVE-2007-1732 | WordPress core | Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators | low | 3.5 | 2% |
| CVE-2021-24521 | side-menu (WordPress plugin) | The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when bu | high | 7.2 | 2% |
| CVE-2021-24341 | english-islamic-calendar (WordPress plugin) | When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST paramete | high | 8.8 | 2% |
| CVE-2014-5184 | stripshow (WordPress plugin) | SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated adminis | medium | 6.5 | 2% |
| CVE-2014-5186 | all-video-gallery (WordPress plugin) | SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators | medium | 6.5 | 2% |
| CVE-2024-13365 | security-malware-firewall (WordPress plugin) | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and extrac | critical | 9.8 | 2% |
| CVE-2015-5483 | private-only (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack t | high | 8.8 | 2% |
| CVE-2024-28119 | getgrav/grav | Server Side Template Injection (SSTI) via Twig escape handler | high | 8.8 | 2% |
| CVE-2019-7912 | magento/community-edition, magento/product-community-edition | Magento Filter extension bypass via crafted store configuration keys | high | 7.2 | 2% |
| CVE-2020-21808 | nukeviet/nukeviet | NukeViet SQL Injection vulnerability via topicsid parameter | critical | 9.8 | 2% |
| CVE-2021-24248 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported fi | high | 7.2 | 2% |
| CVE-2018-19917 | microweber/microweber | Microweber XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2014-8328 | t3/dce | DCE extension for Typo3 Discloses Environment Information | medium | 5.3 | 2% |
| CVE-2022-1580 | site-offline (WordPress plugin) | The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so | medium | 4.3 | 2% |
| CVE-2021-41170 | neoan3-apps/template | Insecure Inherited Permissions in neoan3-apps/template | high | 7.5 | 2% |
| CVE-2021-24657 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers su | medium | 6.1 | 2% |
| CVE-2018-11386 | symfony/http-foundation, symfony/symfony | Symfony DoS | medium | 5.9 | 2% |
| CVE-2020-12073 | gutenberg-\&-elementor-templates-importer-for-responsive (WordPress plugin) | The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests. | high | 8.8 | 2% |
| CVE-2021-45394 | spipu/html2pdf | Cross-site Scripting in HTML2PDF | high | 8.8 | 2% |
| CVE-2018-25019 | learndash (WordPress plugin) | The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_a | high | 7.5 | 2% |
| CVE-2018-19796 | ninja-forms (WordPress plugin) | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessi | medium | 6.1 | 2% |
| CVE-2015-9539 | fast-secure-contact-form (WordPress plugin) | The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS. | medium | 6.1 | 2% |
| CVE-2011-3712 | cakephp/cakephp | CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file | medium | 0.0 | 2% |
| CVE-2015-7791 | welcart-e-commerce (WordPress plugin) | Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users | medium | 6.3 | 2% |
| CVE-2015-5268 | moodle/moodle | Moodle mishandles group-based authorization checks | medium | 4.3 | 2% |
| CVE-2016-2151 | moodle/moodle | Moodle allows attackers to discover student e-mail addresses | medium | 4.3 | 2% |
| CVE-2021-24550 | broken-link-manager (WordPress plugin) | The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL | high | 7.2 | 2% |
| CVE-2021-24552 | simple-events-calendar (WordPress plugin) | The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it | high | 7.2 | 2% |
| CVE-2021-24553 | timeline-calendar (WordPress plugin) | The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL sta | high | 7.2 | 2% |