Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-36836 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 du | high | 8.0 | 1% |
| CVE-2016-1160 | wp-favorite-posts (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitr | medium | 6.1 | 1% |
| CVE-2016-4826 | welcart-e-commerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to injec | medium | 6.1 | 1% |
| CVE-2016-4827 | welcart-e-commerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to injec | medium | 6.1 | 1% |
| CVE-2021-24663 | simple-schools-staff-directory (WordPress plugin) | The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, a | high | 7.2 | 1% |
| CVE-2020-25288 | mantisbt/mantisbt | MantisBT XXS where a Custom Field with a crafted Regular Expression property is used | medium | 4.8 | 1% |
| CVE-2011-5270 | WordPress core | wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticat | medium | 4.0 | 1% |
| CVE-2021-24906 | protect-wp-admin (WordPress plugin) | The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow un | high | 7.5 | 1% |
| CVE-2014-3903 | cakifo (WordPress theme) | Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbi | low | 3.5 | 1% |
| CVE-2015-9474 | simpolio (WordPress theme) | The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates. | high | 8.8 | 1% |
| CVE-2015-9475 | pont (WordPress theme) | The Pont theme 1.5 for WordPress has insufficient restrictions on option updates. | high | 8.8 | 1% |
| CVE-2020-26255 | getkirby/cms, getkirby/panel | Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5 | medium | 6.8 | 1% |
| CVE-2016-7571 | drupal/core, drupal/drupal | Drupal Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-25069 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statemen | high | 8.8 | 1% |
| CVE-2020-13997 | shopware/core, shopware/platform | Shopware database password is leaked to an unauthenticated users | high | 7.5 | 1% |
| CVE-2015-5057 | broken-link-checker (WordPress plugin) | Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed. | medium | 6.1 | 1% |
| CVE-2022-31140 | cuyz/valinor | Valinor error messages leading to potential data exfiltration before v0.12.0 | high | 7.5 | 1% |
| CVE-2022-2187 | contact-form-7-captcha (WordPress plugin) | The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in | medium | 6.1 | 1% |
| CVE-2017-16653 | symfony/security, symfony/security-csrf, symfony/symfony | Symfony CSRF Vulnerability | medium | 5.9 | 1% |
| CVE-2024-1311 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages | high | 8.8 | 1% |
| CVE-2022-3334 | easy-wp-smtp (WordPress plugin) | The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue | high | 7.2 | 1% |
| CVE-2022-3366 | capabilities (WordPress plugin) | The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the co | high | 7.2 | 1% |
| CVE-2018-19790 | symfony/security, symfony/security-http, symfony/symfony | Symfony Open Redirect | medium | 6.1 | 1% |
| CVE-2024-28859 | friendsofsymfony1/swiftmailer, friendsofsymfony1/symfony1, swiftmailer/swiftmailer | Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency | medium | 5.0 | 1% |
| CVE-2021-22970 | concrete5/core | Server-Side Request Forgery in Concrete CMS | medium | 0.0 | 1% |
| CVE-2025-5058 | store-manager-connector (WordPress plugin) | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.8 | 1% |
| CVE-2022-0420 | registrationmagic (WordPress plugin) | The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL stateme | high | 7.2 | 1% |
| CVE-2022-1006 | advanced-booking-calendar (WordPress plugin) | The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which coul | high | 7.2 | 1% |
| CVE-2022-1023 | podcast-importer-secondline (WordPress plugin) | The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQ | high | 7.2 | 1% |
| CVE-2023-6925 | unlimited-addons-for-wpbakery-page-builder (WordPress plugin) | The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type va | high | 7.2 | 1% |
| CVE-2021-44278 | librenms/librenms | Path traversal in librenms/librenms | critical | 9.8 | 1% |
| CVE-2019-10665 | librenms/librenms | LibreNMS Information Disclosure | critical | 9.8 | 1% |
| CVE-2024-2047 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via | high | 8.8 | 1% |
| CVE-2023-0487 | my-sticky-elements (WordPress plugin) | The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement wh | high | 7.2 | 1% |
| CVE-2013-5583 | joomla/joomla-cms | Joomla! Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2020-35935 | advanced-access-manager (WordPress plugin) | The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST par | high | 7.5 | 1% |
| CVE-2022-1034 | showdoc/showdoc | Unrestricted Upload of File with Dangerous Type in ShowDoc | high | 7.2 | 1% |
| CVE-2018-13136 | ultimate-member (WordPress plugin) | The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen. | medium | 6.1 | 1% |
| CVE-2017-8377 | genix/cms | GeniXCMS SQL Injection | high | 8.8 | 1% |
| CVE-2021-24354 | simple-301-redirects (WordPress plugin) | A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin befo | high | 8.8 | 1% |
| CVE-2021-24894 | reviews-plus (WordPress plugin) | The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denia | medium | 6.5 | 1% |
| CVE-2022-1904 | easy-pricing-tables (WordPress plugin) | The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page | medium | 6.1 | 1% |
| CVE-2014-0123 | moodle/moodle | Moodle does not properly restrict access | medium | 0.0 | 1% |
| CVE-2017-9435 | dolibarr/dolibarr | Dolibarr ERP and CRM SQLi | critical | 9.8 | 1% |
| CVE-2021-24956 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter b | medium | 6.1 | 1% |
| CVE-2024-28105 | phpmyfaq/phpmyfaq | phpMyFAQ's File Upload Bypass at Category Image Leads to RCE | high | 7.2 | 1% |
| CVE-2017-2217 | download-manager (WordPress plugin) | Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web | medium | 6.1 | 1% |
| CVE-2019-8153 | magento/community-edition, magento/product-community-edition | Magento Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-4057 | autooptimize (WordPress plugin) | The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs. | medium | 5.3 | 1% |
| CVE-2019-1020002 | pterodactyl/panel | Pterodactyl vulnerable to 2FA Sniffing | high | 7.5 | 1% |