Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-14763 | genix/cms | GeniXCMS arbitrary PHP code execution | high | 8.8 | 1% |
| CVE-2022-25277 | drupal/core | *Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers.* Drupal core sanitizes filenames w | high | 7.2 | 1% |
| CVE-2019-10762 | catfan/medoo | SQL Injection in medoo | critical | 9.8 | 1% |
| CVE-2022-4061 | jobboardwp (WordPress plugin) | The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing un | high | 7.5 | 1% |
| CVE-2020-10196 | popup-builder (WordPress plugin) | An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into exi | medium | 6.1 | 1% |
| CVE-2017-14231 | genix/cms | GeniXCMS denial of service (account blockage) | medium | 5.3 | 1% |
| CVE-2022-1715 | facturascripts/facturascripts | Account takeover in facturascripts | critical | 9.8 | 1% |
| CVE-2019-11633 | honeypress (WordPress plugin) | HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com host | high | 7.5 | 1% |
| CVE-2022-2268 | wp-all-import (WordPress plugin) | The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without valida | high | 7.2 | 1% |
| CVE-2019-9908 | font-organizer (WordPress plugin) | The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS. | medium | 6.1 | 1% |
| CVE-2019-9909 | givewp (WordPress plugin) | The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. | medium | 6.1 | 1% |
| CVE-2022-2599 | anti-malware-security-and-brute-force-firewall (WordPress plugin) | The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outpu | medium | 6.1 | 1% |
| CVE-2021-44350 | topthink/framework | ThinkPHP5 SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2024-20758 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Input Validation | critical | 9.0 | 1% |
| CVE-2017-10843 | baserproject/basercms | Arbitrary file delete in baserCMS | high | 7.5 | 1% |
| CVE-2019-6970 | moodle/moodle | Moodle SSRF Vulnerability | high | 7.5 | 1% |
| CVE-2016-10990 | wp-cerber (WordPress plugin) | The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header. | medium | 6.1 | 1% |
| CVE-2021-4362 | kiwi-social-share (WordPress plugin) | The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_ | critical | 9.8 | 1% |
| CVE-2022-1239 | hubspot (WordPress plugin) | The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with th | high | 8.8 | 1% |
| CVE-2026-45332 | automad/automad | Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint | high | 7.5 | 1% |
| CVE-2018-19993 | dolibarr/dolibarr | Dolibarr reflected cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-24807 | support-board (WordPress plugin) | The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a pay | medium | 5.4 | 1% |
| CVE-2023-30130 | craftcms/cms | CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter | high | 8.8 | 1% |
| CVE-2022-31092 | pimcore/pimcore | Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore | high | 8.1 | 1% |
| CVE-2021-24130 | wp-maps (WordPress plugin) | Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settin | high | 7.2 | 1% |
| CVE-2021-24451 | export-users-with-meta (WordPress plugin) | The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in | high | 7.2 | 1% |
| CVE-2022-0268 | getgrav/grav | Cross-site Scripting in grav | medium | 5.7 | 1% |
| CVE-2015-5484 | wp-plotly (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitra | medium | 5.4 | 1% |
| CVE-2021-43464 | intelliants/subrion | Remote code execution in Subrion | high | 8.8 | 1% |
| CVE-2019-14794 | meta-box (WordPress plugin) | The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. | high | 7.5 | 1% |
| CVE-2023-1263 | cmp-coming-soon-maintenance (WordPress plugin) | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via | medium | 5.3 | 1% |
| CVE-2022-2170 | microsoft-advertising-universal-event-tracking (WordPress plugin) | The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing h | medium | 4.8 | 1% |
| CVE-2020-4050 | WordPress core | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It | low | 3.5 | 1% |
| CVE-2012-2356 | moodle/moodle | Moodle Authentication Bypass in Question-Bank | medium | 0.0 | 1% |
| CVE-2022-28056 | shopxo/shopxo | Incorrect Permission Assignment for Critical Resource in ShopXO | critical | 9.8 | 1% |
| CVE-2022-0242 | bytefury/crater | Unrestricted Upload of File with Dangerous Type in Crater | high | 7.2 | 1% |
| CVE-2025-2907 | order-delivery-date-pro-for-woocommerce (WordPress plugin) | The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it a | critical | 9.8 | 1% |
| CVE-2021-43091 | yeswiki/yeswiki | SQL Injection in Yeswiki | high | 7.5 | 1% |
| CVE-2019-8230 | magento/core | Magento Remote code execution through support/output path modification | high | 7.2 | 1% |
| CVE-2019-8231 | magento/core | Magento Remote code execution through catalog attribute sets | high | 7.2 | 1% |
| CVE-2022-30599 | moodle/moodle | SQL injection in moodle | critical | 9.8 | 1% |
| CVE-2022-0896 | microweber/microweber | Improper Neutralization of Special Elements Used in a Template Engine in microweber | high | 8.8 | 1% |
| CVE-2017-18500 | social-buttons-pack (WordPress plugin) | The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18501 | social-login-bws (WordPress plugin) | The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2018-1081 | moodle/moodle | Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script | medium | 5.3 | 1% |
| CVE-2021-24483 | poll-maker (WordPress plugin) | The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or | high | 7.2 | 1% |
| CVE-2025-0912 | give (WordPress plugin) | The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserializa | critical | 9.8 | 1% |
| CVE-2025-64500 | symfony/http-foundation, symfony/symfony | Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass | high | 7.3 | 1% |
| CVE-2015-9353 | gigpress (WordPress plugin) | The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066. | high | 7.2 | 1% |
| CVE-2019-9576 | blog2social (WordPress plugin) | The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. | medium | 6.1 | 1% |