Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-31777 | t3/dce | SQL Injection in t3/dce | high | 7.6 | 1% |
| CVE-2015-4070 | wow-moodboard-lite (WordPress plugin) | Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote | medium | 6.1 | 1% |
| CVE-2023-29384 | jobwp (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue aff | critical | 10.0 | 1% |
| CVE-2023-24776 | funadmin/funadmin | Remote code execution in Funadmin | critical | 9.8 | 1% |
| CVE-2021-24765 | perfect-survey (WordPress plugin) | The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the | medium | 6.1 | 1% |
| CVE-2019-9942 | twig/twig | Twig Sandbox Information Disclosure | low | 3.7 | 1% |
| CVE-2021-36027 | magento/community-edition, magento/project-community-edition | Magento stored cross-site scripting vulnerability | medium | 0.0 | 1% |
| CVE-2017-18590 | timesheet (WordPress plugin) | The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-1000490 | mautic/core | Mautic users able to download any files from server using filemanager | medium | 6.5 | 1% |
| CVE-2015-5264 | moodle/moodle | Moodle allows attackers to enter additional answer attempts | medium | 5.4 | 1% |
| CVE-2015-8379 | cakephp/cakephp | CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter | high | 8.8 | 1% |
| CVE-2021-25030 | events-made-easy (WordPress plugin) | The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statemen | high | 8.8 | 1% |
| CVE-2022-3869 | froxlor/froxlor | Froxlor vulnerable to code injection | medium | 6.1 | 1% |
| CVE-2021-24457 | portfolio-responsive-gallery (WordPress plugin) | The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-r | high | 8.8 | 1% |
| CVE-2021-41270 | symfony/serializer, symfony/symfony | CSV Injection in symfony/serializer | medium | 6.5 | 1% |
| CVE-2017-18493 | custom-admin-page (WordPress plugin) | The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18494 | custom-search-plugin (WordPress plugin) | The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18496 | htaccess (WordPress plugin) | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2011-4279 | moodle/moodle | Moodle does not use the forceloginforprofiles setting for course-profiles access control | medium | 0.0 | 1% |
| CVE-2014-3546 | moodle/moodle | Moodle allows attackers to obtain username and course information | medium | 0.0 | 1% |
| CVE-2019-16318 | pimcore/pimcore | Pimcore Unrestricted Upload of File with Dangerous Type | high | 8.8 | 1% |
| CVE-2022-28290 | wordpress-country-selector (WordPress plugin) | Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user | medium | 6.1 | 1% |
| CVE-2010-5294 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPres | medium | 4.3 | 1% |
| CVE-2022-0721 | microweber/microweber | Insertion of Sensitive Information Into Debugging Code in Microweber | high | 8.8 | 1% |
| CVE-2021-28556 | magento/community-edition, magento/project-community-edition | Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies | medium | 6.9 | 1% |
| CVE-2021-24934 | visual-css-style-editor (WordPress plugin) | The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back | medium | 6.1 | 1% |
| CVE-2019-17235 | igniteup (WordPress plugin) | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure. | medium | 5.3 | 1% |
| CVE-2022-0385 | crazy-bone (WordPress plugin) | The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them ba | medium | 6.1 | 1% |
| CVE-2021-44618 | nystudio107/craft-seomatic | Server-side Template Injection in nystudio107/craft-seomatic | critical | 9.8 | 1% |
| CVE-2025-24406 | magento/community-edition, magento/project-community-edition | Adobe Commerce Path Traversal | high | 7.5 | 1% |
| CVE-2019-16521 | broken-link-checker (WordPress plugin) | The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encodi | medium | 6.1 | 1% |
| CVE-2013-4744 | oliverklee/phpunit | PHPUnit extension for TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2019-11018 | zoujingli/thinkadmin | ThinkAdmin Administrator cookies still working after password change | critical | 9.8 | 1% |
| CVE-2024-28117 | getgrav/grav | Server Side Template Injection (SSTI) | high | 8.8 | 1% |
| CVE-2021-20185 | moodle/moodle | Moodle Client side denial of service via personal message | medium | 5.3 | 1% |
| CVE-2022-2317 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient che | critical | 9.8 | 1% |
| CVE-2019-16403 | bagisto/bagisto | Authorization Bypass Through User-Controlled Key in Bagisto | high | 8.8 | 1% |
| CVE-2022-40043 | centreon/centreon | Centreon SQL Injection vulnerability via esc_name parameter | high | 8.8 | 1% |
| CVE-2019-18981 | pimcore/pimcore | Pimcore Access Control Issues | critical | 9.8 | 1% |
| CVE-2022-24752 | sylius/grid-bundle | DQL injection through sorting parameters blocked | critical | 9.8 | 1% |
| CVE-2019-12463 | librenms/librenms | Improper Encoding or Escaping of Output and Injection in LibreNMS | high | 8.8 | 1% |
| CVE-2018-20980 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. | high | 7.5 | 1% |
| CVE-2016-10952 | quotes-collection (WordPress plugin) | The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter. | medium | 6.1 | 1% |
| CVE-2023-6220 | piotnetforms (WordPress plugin) | The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetforms | high | 8.1 | 1% |
| CVE-2021-31567 | download-monitor (WordPress plugin) | Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin | medium | 6.8 | 1% |
| CVE-2019-10864 | wp-statistics (WordPress plugin) | The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Ref | medium | 6.1 | 1% |
| CVE-2021-41745 | showdoc/showdoc | Showdoc File Upload Vulnerability | critical | 9.8 | 1% |
| CVE-2024-9634 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | critical | 9.8 | 1% |
| CVE-2017-18564 | sender (WordPress plugin) | The sender plugin before 1.2.1 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18565 | updater (WordPress plugin) | The updater plugin before 1.35 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |