Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24400 | wp-display-users (WordPress plugin) | The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an `id` parameter which is not sanitised, escaped or val | high | 7.2 | 2% |
| CVE-2021-24403 | wpagecontact (WordPress plugin) | The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or valid | high | 7.2 | 2% |
| CVE-2021-24625 | spidercatalog (WordPress plugin) | The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard | high | 7.2 | 2% |
| CVE-2019-14800 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via | medium | 5.3 | 2% |
| CVE-2021-4330 | envato-elements (WordPress plugin), template-kit---import (WordPress plugin) | The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient | high | 8.8 | 2% |
| CVE-2022-3246 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before | high | 8.8 | 2% |
| CVE-2022-3026 | wp-users-exporter (WordPress plugin) | The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' fun | medium | 6.5 | 2% |
| CVE-2016-6613 | phpmyadmin/phpmyadmin | phpMyAdmin Local file exposure through symlinks with UploadDir | medium | 5.3 | 2% |
| CVE-2015-7667 | resads (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in th | medium | 6.1 | 2% |
| CVE-2016-4812 | markdown-on-save-improved (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to injec | medium | 6.1 | 2% |
| CVE-2017-14760 | event-espresso-lite (WordPress plugin) | SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for Wo | critical | 9.8 | 2% |
| CVE-2018-13055 | mantisbt/mantisbt | MantisBT allows XSS via View Filters page | medium | 6.1 | 2% |
| CVE-2021-24602 | hm-multiple-roles (WordPress plugin) | The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin | high | 8.8 | 2% |
| CVE-2020-11066 | typo3/cms, typo3/cms-core | Class destructors causing side-effects when being unserialized in TYPO3 CMS | high | 8.7 | 2% |
| CVE-2022-24093 | magento/community-edition, magento/project-community-edition | Magento Open Source affected by Improper Input Validation | high | 7.2 | 2% |
| CVE-2024-5324 | login\/signup-popup (WordPress plugin), otp-login-woocommerce-\&-gravity-forms (WordPress plugin), side-cart-woocommerce (WordPress plugin) +1 more | Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capabilit | high | 8.8 | 2% |
| CVE-2018-20156 | wp-maintenance-mode (WordPress plugin) | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP co | high | 7.2 | 2% |
| CVE-2022-0537 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS | high | 7.2 | 2% |
| CVE-2017-16558 | contao/contao, contao/core-bundle, contao/listing-bundle +1 more | Contao SQL injection in the backend and listing module | critical | 9.8 | 2% |
| CVE-2024-7772 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' f | critical | 9.8 | 2% |
| CVE-2022-0665 | pimcore/pimcore | Path traversal in pimcore | medium | 6.5 | 2% |
| CVE-2016-10976 | safe-editor (WordPress plugin) | The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS. | medium | 6.1 | 2% |
| CVE-2006-4936 | moodle/moodle | Moodle does not properly validate module instance id | medium | 0.0 | 2% |
| CVE-2026-47212 | symfony/symfony, symfony/twilio-notifier | Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification | medium | 0.0 | 2% |
| CVE-2021-24137 | blog2social (WordPress plugin) | Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing | high | 8.8 | 2% |
| CVE-2021-24149 | modern-events-calendar-lite (WordPress plugin) | Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parame | high | 8.8 | 2% |
| CVE-2018-12071 | codeigniter/framework | CodeIgniter Session Fixation Vulnerability | critical | 9.8 | 2% |
| CVE-2015-5265 | moodle/moodle | Moodle allows attackers to delete files | medium | 4.3 | 2% |
| CVE-2025-54418 | codeigniter4/framework | CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability | critical | 9.8 | 2% |
| CVE-2019-13570 | adrotate (WordPress plugin) | The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection. | high | 7.2 | 2% |
| CVE-2021-25045 | asgaros-forum (WordPress plugin) | The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when | high | 7.2 | 2% |
| CVE-2020-9577 | magento/community-edition, magento/core, magento/project-community-edition | Magento stored cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2020-9581 | magento/community-edition, magento/core, magento/project-community-edition | Magento stored cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2022-46157 | akeneo/pim-community-dev | Akeneo PIM Community Edition vulnerable to remote php code execution | high | 8.8 | 2% |
| CVE-2022-1539 | exports-and-reports (WordPress plugin) | The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lea | high | 8.8 | 2% |
| CVE-2019-10766 | usmanhalalit/pixie | SQL Injection in usmanhalalit/pixie | critical | 9.8 | 1% |
| CVE-2018-0569 | baserproject/basercms | OS Command Injection in baserCMS | high | 8.8 | 1% |
| CVE-2022-43504 | WordPress core | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email addr | medium | 5.3 | 1% |
| CVE-2018-15571 | export-users-to-csv (WordPress plugin) | The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection. | high | 8.6 | 1% |
| CVE-2014-9509 | typo3/cms | Typo3 Vulnerable to Cache Poisoning | high | 0.0 | 1% |
| CVE-2020-29171 | all-in-one-wp-security-and-firewall (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall | medium | 6.1 | 1% |
| CVE-2021-39201 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The iss | high | 7.6 | 1% |
| CVE-2014-5011 | dompdf/dompdf | DOMPDF Information Disclosure | medium | 6.5 | 1% |
| CVE-2021-24374 | automattic/jetpack, jetpack (WordPress plugin) | JetPack Exposure of Resource to Wrong Sphere | medium | 5.3 | 1% |
| CVE-2015-9405 | wp-piwik (WordPress plugin) | The wp-piwik plugin before 1.0.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-36386 | wp-all-import (WordPress plugin) | Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. | critical | 9.1 | 1% |
| CVE-2018-8074 | yiisoft/yii2-dev, yiisoft/yii2-elasticsearch | Yii Framework Code Injection | high | 8.1 | 1% |
| CVE-2021-24977 | use-any-font (WordPress plugin) | The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing | medium | 6.1 | 1% |
| CVE-2012-3531 | typo3/cms | Typo3 Install Tool XSS Vulnerability | medium | 0.0 | 1% |
| CVE-2013-4940 | moodle/moodle | YUI Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 1% |