Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2007-6677 | random-anti-spam-image (WordPress plugin) | Cross-site scripting (XSS) vulnerability in Peter's Random Anti-Spam Image 0.2.4 and earlier plugin for WordPress allows remote attackers to | medium | 4.3 | 1% |
| CVE-2021-4080 | bytefury/crater | crater is vulnerable to Unrestricted Upload of File with Dangerous Type | high | 8.8 | 1% |
| CVE-2006-5734 | phpmailer/phpmailer | PHPMailer Local file inclusion | medium | 0.0 | 1% |
| CVE-2021-25119 | automatic-grid-image-listing (WordPress plugin) | The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file ty | high | 7.2 | 1% |
| CVE-2022-1273 | import-wp (WordPress plugin) | The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin t | high | 7.2 | 1% |
| CVE-2022-1409 | hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users suc | high | 7.2 | 1% |
| CVE-2024-27516 | remdex/livehelperchat | livehelperchat Server-Side Template Injection | medium | 0.0 | 1% |
| CVE-2024-10793 | wp-security-audit-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and i | high | 7.2 | 1% |
| CVE-2022-45152 | moodle/moodle | Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library | critical | 9.1 | 1% |
| CVE-2021-24198 | wpdatatables (WordPress plugin) | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated us | high | 8.1 | 1% |
| CVE-2019-11807 | woocommerce-checkout-manager (WordPress plugin) | The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachm | high | 7.5 | 1% |
| CVE-2020-7994 | dolibarr/dolibarr | Dolibarr cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2019-10905 | erusev/parsedown | Parsedown Class-Name Injection | high | 8.1 | 1% |
| CVE-2019-17231 | onetone (WordPress theme) | includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues. | medium | 6.1 | 1% |
| CVE-2017-10844 | baserproject/basercms | Code Injection in baserCMS | high | 8.8 | 1% |
| CVE-2022-0383 | wp-review-slider (WordPress plugin) | The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could | high | 7.2 | 1% |
| CVE-2022-23911 | ap-custom-testimonial (WordPress plugin) | The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statem | high | 7.2 | 1% |
| CVE-2022-0362 | showdoc/showdoc | SQL Injection in showdoc | medium | 6.7 | 1% |
| CVE-2016-9856 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2016-9857 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-18012 | z-url-preview (WordPress plugin) | The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter. | medium | 6.1 | 1% |
| CVE-2019-15818 | simple-301-redirects-addon-bulk-uploader (WordPress plugin) | The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301expo | medium | 6.1 | 1% |
| CVE-2019-15820 | login-or-logout-menu-item (WordPress plugin) | The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication. | medium | 6.1 | 1% |
| CVE-2020-15721 | francoisjacquet/rosariosis | Cross-site Scripting in RosarioSIS | medium | 6.1 | 1% |
| CVE-2015-1874 | contact-form-7-to-database-extension (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8 | medium | 6.8 | 1% |
| CVE-2023-5070 | ultimate-social-media-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to | medium | 6.5 | 1% |
| CVE-2015-3274 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2015-3275 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | medium | 6.1 | 1% |
| CVE-2016-2152 | moodle/moodle | Moodle XSS from profile fields from external db | medium | 6.1 | 1% |
| CVE-2016-2153 | moodle/moodle | Moodle Reflected XSS in mod_data advanced search | medium | 6.1 | 1% |
| CVE-2024-11635 | wordpress-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the | critical | 9.8 | 1% |
| CVE-2020-24063 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF. | high | 7.2 | 1% |
| CVE-2026-34036 | dolibarr/dolibarr | Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php | medium | 6.5 | 1% |
| CVE-2023-39062 | spipu/html2pdf | Spipu HTML2PDF vulnerable to cross-site scripting | medium | 6.1 | 1% |
| CVE-2023-50262 | dompdf/dompdf | Denial of service caused by infinite recursion when parsing SVG images | medium | 5.3 | 1% |
| CVE-2019-11512 | contao/contao, contao/core-bundle | Contao SQL injection in the file manager | critical | 9.8 | 1% |
| CVE-2022-0687 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to | high | 8.8 | 1% |
| CVE-2022-24800 | october/system | October CMS upload process vulnerable to RCE via Race Condition | high | 8.1 | 1% |
| CVE-2023-4402 | essential-blocks (WordPress plugin), essential-blocks-pro (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization | high | 8.1 | 1% |
| CVE-2022-2261 | wpide (WordPress plugin) | The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the ad | high | 7.2 | 1% |
| CVE-2025-7360 | ht-contactform (WordPress plugin) | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file | critical | 9.1 | 1% |
| CVE-2020-36655 | yiisoft/yii2-gii | Command injection in yiisoft/yii2-gii | high | 8.8 | 1% |
| CVE-2021-32717 | shopware/core, shopware/platform | Private files publicly accessible with Cloud Storage providers | high | 7.5 | 1% |
| CVE-2026-6826 | concrete5/concrete5 | Concrete CMS is vulnerable to unauthenticated file usage disclosure | medium | 0.0 | 1% |
| CVE-2019-12204 | silverstripe/cms, silverstripe/framework | Missing warning can lead to unauthenticated admin access in SilverStripe | critical | 9.8 | 1% |
| CVE-2022-2357 | wsm-downloader (WordPress plugin) | The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, in | high | 7.5 | 1% |
| CVE-2024-9224 | hello-world (WordPress plugin) | The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the hello_world | medium | 6.5 | 1% |
| CVE-2017-14313 | shibboleth (WordPress plugin) | The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due | medium | 6.1 | 1% |
| CVE-2024-10828 | woo-order-export-lite (WordPress plugin) | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3 | high | 8.1 | 1% |
| CVE-2022-23043 | tribalsystems/zenario | File upload restriction bypass in Zenario CMS | high | 7.2 | 1% |