Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-0586 | ultimate-member (WordPress plugin) | Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote au | medium | 4.3 | 2% |
| CVE-2015-4139 | wp-smiley (WordPress plugin) | Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to | low | 3.5 | 2% |
| CVE-2019-18886 | symfony/security-http, symfony/symfony | User enumeration leak using switch user functionality in Symfony | medium | 5.3 | 2% |
| CVE-2024-7313 | shield-security (WordPress plugin) | The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 2% |
| CVE-2014-8622 | compfight (WordPress plugin) | Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users | low | 3.5 | 2% |
| CVE-2015-5640 | baserproject/basercms | baserCMS Access Control Bypass | medium | 0.0 | 2% |
| CVE-2020-14043 | codiad/codiad | Codiad CSRF Vulnerability | high | 8.8 | 2% |
| CVE-2013-2081 | moodle/moodle | Moodle does not consider "don't send" attributes during hub registration | medium | 0.0 | 2% |
| CVE-2022-1683 | amtythumb (WordPress plugin) | The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, | high | 8.8 | 2% |
| CVE-2018-13983 | impresscms/impresscms | ImpressCMS XSS | medium | 6.1 | 2% |
| CVE-2016-3732 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 2% |
| CVE-2021-24336 | flightlog (WordPress plugin) | The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement | high | 7.2 | 2% |
| CVE-2021-24390 | alipay (WordPress plugin) | A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or | high | 7.2 | 2% |
| CVE-2021-24392 | club-management-software (WordPress plugin) | An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated b | high | 7.2 | 2% |
| CVE-2021-24393 | comment-highlighter (WordPress plugin) | A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting | high | 7.2 | 2% |
| CVE-2021-24394 | easy-testimonial-manager (WordPress plugin) | An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting t | high | 7.2 | 2% |
| CVE-2021-24395 | embed-youtube-video (WordPress plugin) | The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to | high | 7.2 | 2% |
| CVE-2021-24628 | wow-forms (WordPress plugin) | The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when dele | high | 7.2 | 2% |
| CVE-2021-24629 | post-content-xmlrpc (WordPress plugin) | The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL state | high | 7.2 | 2% |
| CVE-2021-24747 | seo-booster (WordPress plugin) | The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as | high | 7.2 | 2% |
| CVE-2021-24753 | rich-review (WordPress plugin) | The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page | high | 7.2 | 2% |
| CVE-2024-28861 | friendsofsymfony1/symfony1 | Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder | medium | 0.0 | 2% |
| CVE-2015-9453 | broken-link-manager (WordPress plugin) | The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist. | medium | 6.1 | 2% |
| CVE-2021-24522 | profilepress (WordPress plugin) | The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for | medium | 6.1 | 2% |
| CVE-2020-36724 | wordable (WordPress plugin) | The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of | critical | 9.8 | 2% |
| CVE-2026-30877 | baserproject/basercms | baserCMS Update Functionality Vulnerable to OS Command Injection | critical | 9.1 | 2% |
| CVE-2021-41120 | sylius/paypal-plugin | Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS | high | 7.5 | 2% |
| CVE-2016-5701 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-site Scripting | medium | 6.1 | 2% |
| CVE-2014-5202 | compfight (WordPress plugin) | Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users | low | 3.5 | 2% |
| CVE-2011-4294 | moodle/moodle | Moodle Open Redirect Via Error Messages | medium | 0.0 | 2% |
| CVE-2024-2411 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' p | critical | 9.8 | 2% |
| CVE-2022-0262 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.6 | 2% |
| CVE-2016-9451 | drupal/core | Drupal Open Redirect | medium | 6.8 | 2% |
| CVE-2015-0894 | all-in-one-wp-security-and-firewall (WordPress plugin) | SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute ar | medium | 6.0 | 2% |
| CVE-2022-1173 | getgrav/grav | Stored cross site scripting in getgrav/grav | medium | 5.4 | 2% |
| CVE-2020-25703 | moodle/moodle | Exposure of Sensitive Information to an Unauthorized Actor in Moodle | medium | 5.3 | 2% |
| CVE-2013-4522 | moodle/moodle | Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | medium | 0.0 | 2% |
| CVE-2014-2054 | phpoffice/phpexcel | PHPExcel vulnerable to XXE attacks through libxml | medium | 0.0 | 2% |
| CVE-2018-17566 | topthink/framework | ThinkPHP SQL injection vulnerability | critical | 9.8 | 2% |
| CVE-2021-44135 | pagekit/pagekit | SQL injection in pagekit/pagekit | critical | 9.8 | 2% |
| CVE-2017-14764 | genix/cms | GeniXCMS arbitrary PHP code execution | high | 8.8 | 2% |
| CVE-2022-33011 | idno/known | Known vulnerable to account takeover via host header injection attack in v1.3.1 | high | 8.8 | 2% |
| CVE-2023-6635 | block-options (WordPress plugin) | The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' funct | high | 7.2 | 2% |
| CVE-2009-3629 | typo3/cms-backend | TYPO3 Backend vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2016-9188 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2019-16126 | getgrav/grav | Cross-site Scripting in Grav | medium | 6.1 | 2% |
| CVE-2022-0478 | event-manager-and-tickets-selling-for-woocommerce (WordPress plugin) | The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg p | high | 8.8 | 2% |
| CVE-2015-8606 | silverstripe/cms | Silverstripe CMS XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2022-0828 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an atta | high | 7.5 | 2% |
| CVE-2023-25654 | baserproject/basercms | baserCMS File Uploader Remote Code Execution (RCE) vulnerability | critical | 9.8 | 2% |