Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-20746 | wordpress-popular-posts (WordPress plugin) | Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrar | medium | 5.4 | 1% |
| CVE-2019-18985 | pimcore/pimcore | Pimcore 2FA Vulnerable to Brute Forcing | critical | 9.8 | 1% |
| CVE-2017-18532 | realty (WordPress plugin) | The realty plugin before 1.1.0 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2018-18576 | wordpress-popup (WordPress plugin) | The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/a | medium | 5.3 | 1% |
| CVE-2022-3574 | wpforms-pro (WordPress plugin) | The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV inje | critical | 9.8 | 1% |
| CVE-2022-33012 | microweber/microweber | Account Takeover Through Password Reset Poisoning | high | 8.8 | 1% |
| CVE-2021-4134 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID param | high | 7.2 | 1% |
| CVE-2020-14207 | divebook (WordPress plugin) | The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data fro | medium | 5.3 | 1% |
| CVE-2021-24163 | ninja-forms (WordPress plugin) | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protect | high | 8.8 | 1% |
| CVE-2021-24184 | tutor-lms (WordPress plugin) | Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing stud | high | 8.8 | 1% |
| CVE-2025-4336 | store-manager-connector (WordPress plugin) | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | high | 8.1 | 1% |
| CVE-2021-24940 | persian-woocommerce (WordPress plugin) | The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admi | medium | 6.1 | 1% |
| CVE-2022-0599 | mapping-multiple-urls-redirect-same-page (WordPress plugin) | The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before output | medium | 6.1 | 1% |
| CVE-2022-35689 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Access Control | medium | 5.3 | 1% |
| CVE-2020-9455 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary ema | medium | 4.3 | 1% |
| CVE-2018-20231 | two-factor-authentication (WordPress plugin) | Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA | high | 8.8 | 1% |
| CVE-2019-7911 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Server-Side Request Forgery vulnerability | high | 7.2 | 1% |
| CVE-2019-7913 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SSRF vulnerability | high | 7.2 | 1% |
| CVE-2019-7923 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SSRF vulnerability | high | 7.2 | 1% |
| CVE-2021-24876 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attr | medium | 6.1 | 1% |
| CVE-2022-0509 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 5.4 | 1% |
| CVE-2023-49075 | pimcore/admin-ui-classic-bundle | Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls | high | 8.4 | 1% |
| CVE-2022-1219 | pimcore/pimcore | SQL Injection in Pimcore | high | 7.5 | 1% |
| CVE-2020-11030 | WordPress core | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the | medium | 6.4 | 1% |
| CVE-2023-6316 | mw-wp-form (WordPress plugin) | The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_up | critical | 9.8 | 1% |
| CVE-2022-41876 | ezsystems/ezplatform-graphql | ezplatform-graphql GraphQL queries can expose password hashes | high | 7.5 | 1% |
| CVE-2022-1910 | shortcodes-and-extra-features-for-phlox-theme (WordPress plugin) | The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back | medium | 6.1 | 1% |
| CVE-2018-0576 | events-manager (WordPress plugin) | Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary w | medium | 5.4 | 1% |
| CVE-2015-8760 | typo3/cms | TYPO3 allows remote attackers to embed Flash videos from external domain | medium | 6.1 | 1% |
| CVE-2009-1149 | phpmyadmin/phpmyadmin | phpMyAdmin HTTP Response Splitting Vulnerability | high | 0.0 | 1% |
| CVE-2014-7835 | moodle/moodle | Moodle allows attackers to upload files containing JavaScript | low | 0.0 | 1% |
| CVE-2021-3838 | dompdf/dompdf | Deserialization of Untrusted Data in dompdf/dompdf | critical | 9.8 | 1% |
| CVE-2017-2216 | download-manager (WordPress plugin) | Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web scr | medium | 6.1 | 1% |
| CVE-2018-5288 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page. | medium | 6.1 | 1% |
| CVE-2020-29653 | froxlor/froxlor | HTML Injection in Froxlor | medium | 6.1 | 1% |
| CVE-2020-13278 | francoisjacquet/rosariosis | Reflected cross-site scripting in francoisjacquet/rosariosis | medium | 6.1 | 1% |
| CVE-2012-5181 | concrete5/concrete5 | Concrete5 Vulnerable to Cross-Site Scripting (XSS) | medium | 0.0 | 1% |
| CVE-2021-28563 | magento/community-edition | Magento Unauthorized access to restricted resources | medium | 6.5 | 1% |
| CVE-2020-5296 | october/cms | Arbitrary File Deletion vulnerability in OctoberCMS | medium | 6.2 | 1% |
| CVE-2020-10959 | mediawiki/core | MediaWiki Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2020-9665 | magento/core | Magento stored cross-site scripting vulnerability | medium | 6.1 | 1% |
| CVE-2016-2159 | moodle/moodle | Moodle External function mod_assign_save_submission does not check due dates | medium | 4.3 | 1% |
| CVE-2015-9331 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. | high | 7.5 | 1% |
| CVE-2021-36396 | moodle/moodle | Moodle vulnerable to Server-Side Request Forgery | high | 7.5 | 1% |
| CVE-2021-43676 | matyhtf/framework | Path manipulation in matyhtf/framework | critical | 9.8 | 1% |
| CVE-2022-2240 | request-a-quote (WordPress plugin) | The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a maliciou | high | 8.8 | 1% |
| CVE-2016-3163 | drupal/core, drupal/drupal | Drupal Brute force amplification attacks via XML-RPC | high | 7.5 | 1% |
| CVE-2021-28566 | magento/community-edition | Magento Information Disclosure vulnerability | low | 3.7 | 1% |
| CVE-2022-0913 | microweber/microweber | Integer Overflow or Wraparound in Microweber | high | 7.5 | 1% |
| CVE-2012-1159 | moodle/moodle | Moodle included private user files in course backups | medium | 4.3 | 1% |