Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-28235 | contao/core-bundle | Contao: Possible cookie sharing with external domains while checking protected pages for broken links | high | 8.3 | 1% |
| CVE-2024-34080 | mantisbt/mantisbt | MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2022-36101 | shopware/shopware | Shopware contains sensitive data in backend customer module | medium | 5.4 | 1% |
| CVE-2023-48294 | librenms/librenms | LibreNMS has Broken Access control on Graphs Feature | medium | 4.3 | 1% |
| CVE-2022-44589 | google-authenticator (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Fac | high | 8.1 | 1% |
| CVE-2019-16698 | directmailteam/direct-mail | direct_mail for Typo3 sensitive data exposure | medium | 4.3 | 1% |
| CVE-2017-20178 | codiad/codiad | Codiad information disclosure vulnerability | high | 7.5 | 1% |
| CVE-2023-4139 | wp-ultimate-csv-importer (WordPress plugin) | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing rest | high | 7.5 | 1% |
| CVE-2022-41655 | phone-orders-for-woocommerce (WordPress plugin) | Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress. | medium | 4.3 | 1% |
| CVE-2024-2093 | vk-all-in-one-expansion-unit (WordPress plugin) | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 6.5 | 1% |
| CVE-2022-1663 | stop-spam-comments (WordPress plugin) | The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comme | medium | 6.5 | 1% |
| CVE-2023-47126 | typo3/cms-install | Information Disclosure in typo3/cms-install tool | low | 3.7 | 1% |
| CVE-2023-3132 | mainwp-child (WordPress plugin) | The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insuf | medium | 5.9 | 1% |
| CVE-2023-3819 | pimcore/pimcore | Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | high | 7.6 | 1% |
| CVE-2021-32050 | mongodb/mongodb | MongoDB Driver may publish events containing authentication-related data | medium | 4.2 | 1% |
| CVE-2023-0901 | pixelfed/pixelfed | Pixelfed allows user enumeration via reset password functionality | medium | 5.3 | 1% |
| CVE-2020-36668 | backup (WordPress plugin) | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and i | medium | 4.3 | 1% |
| CVE-2022-31046 | typo3/cms, typo3/cms-core | Information Disclosure via Export Module | medium | 4.3 | 1% |
| CVE-2024-45134 | magento/community-edition | Magento Open Source Information Exposure vulnerability | low | 2.7 | 1% |
| CVE-2026-62988 | froxlor/froxlor | Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints | critical | 9.0 | 1% |
| CVE-2024-11088 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via t | medium | 5.3 | 1% |
| CVE-2024-10285 | ce21-suite (WordPress plugin) | The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and includin | critical | 9.8 | 1% |
| CVE-2014-125102 | relevant (WordPress plugin) | A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability | medium | 4.3 | 1% |
| CVE-2023-6214 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | high | 7.5 | 1% |
| CVE-2023-34098 | shopware/shopware | Shopware dependency configuration exposed | medium | 5.3 | 1% |
| CVE-2024-1769 | jm-twitter-cards (WordPress plugin) | The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta descri | medium | 5.3 | 1% |
| CVE-2024-11297 | page-and-post-restriction (WordPress plugin) | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers | medium | 5.3 | 1% |
| CVE-2024-0909 | anonymous-restricted-content (WordPress plugin) | The Anonymous Restricted Content plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.6.2. T | medium | 5.3 | 1% |
| CVE-2023-22476 | mantisbt/mantisbt | MantisBT may expose private issues' summaries to unauthorized users | medium | 4.3 | 1% |
| CVE-2024-21549 | spatie/browsershot | Browsershot Improper Input Validation vulnerability | high | 8.6 | 1% |
| CVE-2022-41618 | media-library-assistant (WordPress plugin) | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. | low | 3.7 | 1% |
| CVE-2020-5218 | sylius/resource-bundle, sylius/sylius | Ability to expose data in Sylius by using an unintended serialisation group | medium | 4.4 | 1% |
| CVE-2023-3779 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including | medium | 5.3 | 1% |
| CVE-2025-8620 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and | medium | 5.3 | 1% |
| CVE-2023-5545 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability | medium | 5.3 | 1% |
| CVE-2021-24945 | like-button-rating (WordPress plugin) | The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes | high | 8.0 | 1% |
| CVE-2023-3709 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 | medium | 5.3 | 1% |
| CVE-2024-11089 | anonymous-restricted-content (WordPress plugin) | The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 1% |
| CVE-2024-2541 | popup-builder (WordPress plugin) | The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the S | medium | 5.3 | 1% |
| CVE-2024-25118 | typo3/cms-core | TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords | medium | 4.3 | 1% |
| CVE-2020-10945 | centreon/centreon | Centreon Sensitive Data Exposure vulnerability | medium | 4.3 | 1% |
| CVE-2024-8538 | tuxedo-big-file-uploads (WordPress plugin) | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, a | medium | 4.3 | 1% |
| CVE-2023-28334 | moodle/moodle | Moodle may allow authenticated users to enumerate other user's names via learning plans page | medium | 4.3 | 1% |
| CVE-2020-36835 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's databa | medium | 4.9 | 1% |
| CVE-2022-23504 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration | medium | 5.7 | 1% |
| CVE-2024-4266 | metform (WordPress plugin) | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Ex | medium | 5.3 | 1% |
| CVE-2024-25120 | typo3/cms-core | TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme | medium | 4.3 | 1% |
| CVE-2023-28421 | wp-email-capture (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture | medium | 5.3 | 1% |
| CVE-2024-1083 | simple-restrict (WordPress plugin) | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the | medium | 5.3 | 1% |
| CVE-2023-27447 | wp-sms (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, | medium | 5.3 | 1% |