Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-38887 | dolibarr/dolibarr | File Upload vulnerability in Dolibarr ERP CRM | high | 8.8 | 2% |
| CVE-2020-35012 | events-manager (WordPress plugin) | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an | high | 7.2 | 2% |
| CVE-2021-24511 | product-feed-on-woocommerce (WordPress plugin) | The fetch_product_ajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a `product_id` POST parameter w | high | 7.2 | 2% |
| CVE-2021-24844 | affiliates-manager (WordPress plugin) | The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admi | high | 7.2 | 2% |
| CVE-2014-9129 | cm-download-manager (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote at | medium | 6.8 | 2% |
| CVE-2014-8326 | phpmyadmin/phpmyadmin | phpMyAdmin Implementation XSS Vulnerability on Server Monitor Page | medium | 0.0 | 2% |
| CVE-2023-43655 | composer/composer | Composer Remote Code Execution vulnerability via web-accessible composer.phar | high | 8.8 | 2% |
| CVE-2019-16217 | WordPress core | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | medium | 6.1 | 2% |
| CVE-2022-0230 | bwp-google-xml-sitemaps (WordPress plugin) | The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the ad | medium | 6.1 | 2% |
| CVE-2019-16520 | all-in-one-seo-pack (WordPress plugin) | The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of | medium | 5.4 | 2% |
| CVE-2021-24834 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Opti | medium | 5.4 | 2% |
| CVE-2014-0127 | moodle/moodle | Moodle's time-validation implementation allows bypassing intended restrictions | medium | 0.0 | 2% |
| CVE-2021-42112 | limesurvey/limesurvey | Cross-site Scripting in Limesurvey | medium | 6.1 | 2% |
| CVE-2023-4274 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. | high | 8.7 | 2% |
| CVE-2018-20465 | craftcms/cms | Craft CMS Vulnerable to Server-Side Template Injection | high | 7.2 | 2% |
| CVE-2008-0618 | dmsguestbook (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allow remote attackers to injec | medium | 4.3 | 2% |
| CVE-2019-12747 | typo3/cms, typo3/cms-core | TYPO3 Vulnerable to Insecure Deserialization | high | 8.8 | 2% |
| CVE-2020-11025 | WordPress core | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code | medium | 5.8 | 2% |
| CVE-2016-10947 | post-indexer (WordPress plugin) | The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin. | high | 7.2 | 2% |
| CVE-2011-3127 | WordPress core | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party | medium | 5.8 | 2% |
| CVE-2010-1617 | moodle/moodle | Moodle doesn't properly check role | low | 0.0 | 2% |
| CVE-2016-10893 | crayon-syntax-highlighter (WordPress plugin) | The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests. | medium | 6.1 | 2% |
| CVE-2015-3179 | moodle/moodle | Moodle allows attackers to bypass intended login restrictions | low | 0.0 | 2% |
| CVE-2013-2008 | wp-super-cache (WordPress plugin) | WordPress Super Cache Plugin 1.3 has XSS. | medium | 6.1 | 2% |
| CVE-2021-25107 | form-store-to-db (WordPress plugin) | The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entr | medium | 6.1 | 2% |
| CVE-2014-6289 | dl/yag, punktde/pt_extbase | yag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions | high | 0.0 | 2% |
| CVE-2021-4356 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, | critical | 9.0 | 2% |
| CVE-2007-4893 | WordPress core | wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_h | medium | 4.3 | 2% |
| CVE-2021-25002 | tipsacarrier (WordPress plugin) | The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenti | high | 7.5 | 2% |
| CVE-2022-2717 | joomsport-sports-league-results-management (WordPress plugin) | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' par | high | 7.2 | 2% |
| CVE-2022-2718 | joomsport-sports-league-results-management (WordPress plugin) | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' par | high | 7.2 | 2% |
| CVE-2022-3374 | ocean-extra (WordPress plugin) | The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues | high | 7.2 | 2% |
| CVE-2015-2293 | wordpress-seo (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin be | medium | 6.8 | 2% |
| CVE-2023-1406 | jetengine-for-elementor (WordPress plugin) | The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a | high | 8.8 | 2% |
| CVE-2020-24405 | magento/community-edition | Magento incorrect permissions vulnerability in the Inventory module | medium | 4.3 | 2% |
| CVE-2024-10508 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation v | critical | 9.8 | 2% |
| CVE-2020-36701 | kingcomposer (WordPress plugin) | The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the | high | 8.8 | 2% |
| CVE-2016-10983 | ghost (WordPress plugin) | The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data. | medium | 6.5 | 2% |
| CVE-2025-46731 | craftcms/cms | Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI | high | 0.0 | 2% |
| CVE-2025-4603 | store-manager-connector (WordPress plugin) | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path vali | critical | 9.1 | 2% |
| CVE-2021-24919 | wicked-folders (WordPress plugin) | The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in | high | 8.8 | 2% |
| CVE-2022-0411 | asgaros-forum (WordPress plugin) | The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a | high | 8.8 | 2% |
| CVE-2022-3335 | kadence-woocommerce-email-designer (WordPress plugin) | The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP o | high | 7.2 | 2% |
| CVE-2019-14936 | easy\!appointments (WordPress plugin) | Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). | medium | 5.3 | 2% |
| CVE-2020-13909 | facade/ignition | Critical severity vulnerability in Ignition | critical | 9.8 | 2% |
| CVE-2021-25087 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unaut | high | 7.5 | 2% |
| CVE-2021-24396 | gseor (WordPress plugin) | A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before insert | high | 7.2 | 2% |
| CVE-2021-24397 | microcopy (WordPress plugin) | The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter use | high | 7.2 | 2% |
| CVE-2021-24398 | responsive-3d-slider (WordPress plugin) | The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escape | high | 7.2 | 2% |
| CVE-2021-24399 | the-sorter (WordPress plugin) | The check_order function of The Sorter WordPress plugin through 1.0 uses an `area_id` parameter which is not sanitised, escaped or validated | high | 7.2 | 2% |