Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-12872 | simplesamlphp/simplesamlphp | SimpleSAMLphp allows timing side-channel attacks | medium | 5.9 | 1% |
| CVE-2023-6700 | wp-gdpr-compliance (WordPress plugin) | The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capabili | high | 8.8 | 1% |
| CVE-2024-9772 | uix-shortcodes (WordPress plugin) | The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to | high | 7.3 | 1% |
| CVE-2017-18015 | share-this-image (WordPress plugin) | The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter. | medium | 6.1 | 1% |
| CVE-2017-18487 | adsense-plugin (WordPress plugin) | The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18490 | contact-form-multi (WordPress plugin) | The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18491 | contact-form-plugin (WordPress plugin) | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18492 | contact-form-to-db (WordPress plugin) | The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2013-4997 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple cross-site scripting (XSS) vulnerabilities | medium | 0.0 | 1% |
| CVE-2017-9840 | dolibarr/dolibarr | Dolibarr ERP and CRM Unsafe File Upload Vulnerability | high | 8.8 | 1% |
| CVE-2021-24125 | contact-form-submissions (WordPress plugin) | Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET p | high | 7.2 | 1% |
| CVE-2022-25811 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before usin | high | 7.2 | 1% |
| CVE-2022-0257 | pimcore/pimcore | pimcore is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-0285 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 5.4 | 1% |
| CVE-2023-51450 | baserproject/basercms | baserCMS OS command injection vulnerability in Installer | medium | 5.6 | 1% |
| CVE-2014-7830 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2023-3186 | popup (WordPress plugin) | The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitr | critical | 9.8 | 1% |
| CVE-2019-7859 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Path Traversal Vulnerability | high | 7.5 | 1% |
| CVE-2022-0920 | salon-booking-system (WordPress plugin) | The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could | high | 7.5 | 1% |
| CVE-2018-1043 | moodle/moodle | Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames | medium | 6.5 | 1% |
| CVE-2018-0546 | wp-all-import (WordPress plugin) | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web s | medium | 6.1 | 1% |
| CVE-2018-0547 | wp-all-import (WordPress plugin) | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web s | medium | 6.1 | 1% |
| CVE-2022-28666 | custom-product-tabs-for-woocommerce (WordPress plugin) | Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-con | medium | 5.3 | 1% |
| CVE-2018-12534 | quick-chat (WordPress plugin) | A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress. | critical | 9.8 | 1% |
| CVE-2019-19848 | typo3/cms, typo3/cms-core | TYPO3 Directory Traversal on ZIP extraction | medium | 6.8 | 1% |
| CVE-2019-15570 | bedita/bedita | BEdita vulnerable to SQL injection | critical | 9.8 | 1% |
| CVE-2022-1412 | log-wp-mail (WordPress plugin) | The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any u | high | 7.5 | 1% |
| CVE-2022-2536 | transposh-translation-filter-for-wordpress (WordPress plugin) | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions | medium | 5.3 | 1% |
| CVE-2018-7644 | simplesamlphp/saml2 | SimpleSAMLphp Improper Verification of Cryptographic Signature | high | 7.5 | 1% |
| CVE-2014-9310 | wordpress-backup-to-dropbox (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress. | medium | 6.1 | 1% |
| CVE-2013-1833 | moodle/moodle | Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module | low | 0.0 | 1% |
| CVE-2022-1939 | allow-svg-files (WordPress plugin) | The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as ad | high | 7.2 | 1% |
| CVE-2011-3591 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple XSS Vulnerabilities After Inline Editing and Save | low | 0.0 | 1% |
| CVE-2011-3592 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple XSS Vulnerabilities | low | 0.0 | 1% |
| CVE-2012-4345 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page | low | 0.0 | 1% |
| CVE-2012-5339 | phpmyadmin/phpmyadmin | phpMyAdmin multiple cross-site scripting vulnerabilities | low | 0.0 | 1% |
| CVE-2014-3943 | typo3/cms | Typo3 XSS Vulnerabilities | low | 0.0 | 1% |
| CVE-2015-0212 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2015-0216 | moodle/moodle | Moodle does not set the RISK_XSS bit for graders | low | 0.0 | 1% |
| CVE-2015-2273 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2015-3174 | moodle/moodle | Moodle does not set the RISK_XSS bit for graders | low | 0.0 | 1% |
| CVE-2015-3178 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2022-2903 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object inj | high | 7.2 | 1% |
| CVE-2022-0206 | newstatpress (WordPress plugin) | The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, lead | medium | 6.1 | 1% |
| CVE-2013-4751 | symfony/symfony, symfony/validator | Symfony collectionCascaded and collectionCascadedDeeply fields security bypass | high | 8.1 | 1% |
| CVE-2022-37333 | exceedone/exment, exceedone/laravel-admin | exceedone/exment and exceedone/laravel-admin SQL Injection vulnerability | high | 8.8 | 1% |
| CVE-2021-24131 | anti-spam (WordPress plugin) | Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulner | high | 7.2 | 1% |
| CVE-2021-25104 | ocean-extra (WordPress plugin) | The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a R | medium | 6.1 | 1% |
| CVE-2022-0440 | catch-themes-demo-import (WordPress plugin) | The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivil | high | 7.2 | 1% |
| CVE-2022-0593 | login-with-phone-number (WordPress plugin) | The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks | medium | 6.5 | 1% |