Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-28585 | magento/community-edition, magento/project-community-edition | Magento Improper input validation vulnerability | medium | 5.3 | 2% |
| CVE-2014-4855 | polylang (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2014-4856 | polldaddy (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inje | medium | 4.3 | 2% |
| CVE-2016-10949 | relevanssi (WordPress plugin) | The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization. | high | 8.8 | 2% |
| CVE-2017-2643 | moodle/moodle | Moodle Global search displays user names for unauthenticated users | medium | 5.3 | 2% |
| CVE-2020-21809 | nukeviet/nukeviet | NukeViet SQL Injection vulnerability | critical | 9.8 | 2% |
| CVE-2016-10968 | peepso-core (WordPress plugin) | The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation. | high | 8.8 | 2% |
| CVE-2017-18602 | ibps-online-exam (WordPress plugin) | The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter. | high | 8.8 | 2% |
| CVE-2018-5310 | media-from-ftp (WordPress plugin) | In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?p | medium | 6.5 | 2% |
| CVE-2015-9230 | bulletproof-security (WordPress plugin) | In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible f | medium | 4.8 | 2% |
| CVE-2022-3754 | thorsten/phpmyfaq | phpMyFAQ contains Weak Password Requirements | critical | 9.8 | 2% |
| CVE-2019-9568 | forminator (WordPress plugin) | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=formina | medium | 6.5 | 2% |
| CVE-2021-41165 | ckeditor/ckeditor | HTML comments vulnerability allowing to execute JavaScript code | high | 8.2 | 2% |
| CVE-2022-0148 | mystickyelements (WordPress plugin) | The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on | medium | 5.4 | 2% |
| CVE-2014-5344 | mobiloud-mobile-app-plugin (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow rem | medium | 4.3 | 2% |
| CVE-2014-6445 | contact-form-7-integrations (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for Wor | medium | 4.3 | 2% |
| CVE-2026-28501 | wwbn/avideo | AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php | critical | 9.8 | 2% |
| CVE-2021-24549 | aceide (WordPress plugin) | The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in | medium | 4.9 | 2% |
| CVE-2026-41247 | studio-42/elfinder | elFinder: Command injection in resize background color parameter when using ImageMagick CLI | critical | 9.8 | 2% |
| CVE-2014-2550 | disable-comments (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack | high | 8.8 | 2% |
| CVE-2021-24337 | video-embed-box (WordPress plugin) | The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validat | high | 8.8 | 2% |
| CVE-2021-24391 | cashtomer (WordPress plugin) | An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to | high | 8.8 | 2% |
| CVE-2021-24520 | out-of-stock-message-for-woocommerce (WordPress plugin) | The Stock in & out WordPress plugin through 1.0.4 lacks proper sanitization before passing variables to an SQL request, making it vulnerable | high | 8.8 | 2% |
| CVE-2017-16790 | symfony/form, symfony/symfony | Symfony SSRF Vulnerability via Form Component | medium | 6.5 | 2% |
| CVE-2016-0725 | moodle/moodle | Moodle Cross-site scripting (XSS) vulnerability in course management search | medium | 6.1 | 2% |
| CVE-2021-24630 | schreikasten (WordPress plugin) | The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the | high | 8.8 | 2% |
| CVE-2021-24631 | unlimited-popups (WordPress plugin) | The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, av | high | 8.8 | 2% |
| CVE-2021-24726 | wp-simple-booking-calendar (WordPress plugin) | The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calend | high | 8.8 | 2% |
| CVE-2015-5266 | moodle/moodle | Moodle allows attackers to obtain manager privileges | medium | 6.8 | 2% |
| CVE-2015-4337 | xcloner (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web | low | 3.5 | 2% |
| CVE-2022-31091 | guzzlehttp/guzzle | Change in port not treated as a change in origin; sensitive headers leaked on redirect | high | 8.1 | 2% |
| CVE-2021-24348 | side-menu (WordPress plugin) | The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users take | high | 7.2 | 2% |
| CVE-2019-5715 | silverstripe/framework | Silverstripe Framework SQLi Vulnerability | critical | 9.8 | 2% |
| CVE-2021-24537 | similar-posts (WordPress plugin) | The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie wit | high | 7.2 | 2% |
| CVE-2019-19709 | mediawiki/core | Possible to circumvent title-blacklist | medium | 6.1 | 2% |
| CVE-2024-3022 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpress_p | high | 7.2 | 2% |
| CVE-2017-18011 | affiliate-ads-for-clickbank-products (WordPress plugin) | The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter | medium | 6.1 | 2% |
| CVE-2011-4297 | moodle/moodle | Moodle does not properly restrict comment capabilities | medium | 0.0 | 2% |
| CVE-2022-0147 | wp-gdpr-compliance (WordPress plugin) | The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in att | medium | 6.1 | 2% |
| CVE-2018-0503 | mediawiki/core | Mediawiki Improper Privilege Management | medium | 4.3 | 2% |
| CVE-2005-3621 | phpmyadmin/phpmyadmin | phpMyAdmin CRLF Injection Vulnerability | medium | 0.0 | 2% |
| CVE-2018-8073 | yiisoft/yii2-redis | yii2-redis Potential Remote code execution | critical | 9.8 | 2% |
| CVE-2021-21032 | magento/community-edition, magento/project-community-edition | Magento Insufficient Session Expiration | medium | 5.6 | 2% |
| CVE-2011-0986 | phpmyadmin/phpmyadmin | phpMyAdmin allows remote attackers to obtain installation path via direct request for nonexistent file | medium | 0.0 | 2% |
| CVE-2021-20750 | ec-cube/ec-cube | EC-CUBE Cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2022-3076 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any | high | 7.2 | 2% |
| CVE-2023-4141 | wp-ultimate-csv-importer (WordPress plugin) | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '-> | high | 8.0 | 2% |
| CVE-2023-4142 | wp-ultimate-csv-importer (WordPress plugin) | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '-> | high | 8.0 | 2% |
| CVE-2021-24772 | stream (WordPress plugin) | The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard befo | high | 8.8 | 2% |
| CVE-2020-36726 | ultimate-reviews (WordPress plugin) | The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization | critical | 9.8 | 2% |