Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-18566 | user-role (WordPress plugin) | The user-role plugin before 1.5.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2024-11150 | user-extra-fields (WordPress plugin) | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in th | critical | 9.8 | 1% |
| CVE-2015-9318 | awesome-support (WordPress plugin) | The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies. | high | 7.5 | 1% |
| CVE-2015-9338 | wp-file-upload (WordPress plugin) | The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files. | high | 7.5 | 1% |
| CVE-2015-9339 | wp-file-upload (WordPress plugin) | The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files. | high | 7.5 | 1% |
| CVE-2015-9340 | wp-file-upload (WordPress plugin) | The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, | high | 7.5 | 1% |
| CVE-2015-9341 | wp-file-upload (WordPress plugin) | The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files. | high | 7.5 | 1% |
| CVE-2015-9345 | link-log (WordPress plugin) | The link-log plugin before 2.0 for WordPress has HTTP Response Splitting. | high | 7.5 | 1% |
| CVE-2019-14791 | appointment-booking-calendar (WordPress plugin) | The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. | medium | 6.1 | 1% |
| CVE-2019-9646 | contact-form-to-email (WordPress plugin) | The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the | medium | 6.1 | 1% |
| CVE-2019-9910 | kingcomposer (WordPress plugin) | The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS. | medium | 6.1 | 1% |
| CVE-2021-4343 | ulisting (WordPress plugin) | The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including | critical | 9.8 | 1% |
| CVE-2021-4370 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated user | critical | 9.8 | 1% |
| CVE-2021-4381 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing securit | critical | 9.8 | 1% |
| CVE-2023-22731 | shopware/core, shopware/platform | Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views | critical | 9.8 | 1% |
| CVE-2021-32693 | symfony/security-http, symfony/symfony | Authentication granted to all firewalls instead of just one | medium | 6.8 | 1% |
| CVE-2017-18542 | zendesk-help-center (WordPress plugin) | The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2021-24241 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attri | medium | 6.1 | 1% |
| CVE-2022-2168 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history | medium | 6.1 | 1% |
| CVE-2012-2112 | typo3/cms | Typo3 Exception Handler XSS | medium | 0.0 | 1% |
| CVE-2024-7385 | wp-simple-html-sitemap (WordPress plugin) | The WordPress Simple HTML Sitemap plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and incl | critical | 9.1 | 1% |
| CVE-2016-1912 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerabilities | medium | 5.4 | 1% |
| CVE-2020-13675 | drupal/core, drupal/graphql | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all | critical | 9.8 | 1% |
| CVE-2020-25701 | moodle/moodle | Privilage Escalation in moodle | medium | 5.3 | 1% |
| CVE-2020-5680 | ec-cube/ec-cube | EC-CUBE Improper input validation vulnerability | high | 7.5 | 1% |
| CVE-2017-18530 | rating-bws (WordPress plugin) | The rating-bws plugin before 0.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18556 | bws-google-analytics (WordPress plugin) | The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18557 | bws-google-maps (WordPress plugin) | The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18558 | bws-testimonials (WordPress plugin) | The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18562 | error-log-viewer (WordPress plugin) | The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2026-31843 | goodoneuz/pay-uz | goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files | critical | 9.8 | 1% |
| CVE-2015-7682 | pie-register (WordPress plugin) | Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote | medium | 6.5 | 1% |
| CVE-2019-17228 | motors-car-dealership-classified-listings (WordPress plugin) | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for Wo | medium | 6.5 | 1% |
| CVE-2005-4875 | typo3/cms | TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/` | high | 0.0 | 1% |
| CVE-2017-18596 | elementor (WordPress plugin) | The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions. | high | 8.8 | 1% |
| CVE-2017-5489 | WordPress core | Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecifie | high | 8.8 | 1% |
| CVE-2021-4448 | kaswara (WordPress plugin) | The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insuf | high | 7.3 | 1% |
| CVE-2019-14786 | seo (WordPress plugin) | The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb paramet | medium | 6.5 | 1% |
| CVE-2022-0493 | string-locator (WordPress plugin) | The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege us | medium | 4.9 | 1% |
| CVE-2021-24769 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL stat | high | 7.2 | 1% |
| CVE-2022-32115 | idno/known | Known vulnerable to code execution via SVG file in v1.3.1 | medium | 6.1 | 1% |
| CVE-2012-2353 | moodle/moodle | Moodle Exposes Sensitive User Information | medium | 0.0 | 1% |
| CVE-2023-6972 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backu | critical | 9.8 | 1% |
| CVE-2018-20678 | librenms/librenms | LibreNMS SQL Injection | high | 8.8 | 1% |
| CVE-2022-25306 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parame | high | 7.2 | 1% |
| CVE-2022-25307 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform param | high | 7.2 | 1% |
| CVE-2018-16363 | file-manager (WordPress plugin) | The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request | medium | 5.4 | 1% |
| CVE-2017-18584 | post-pay-counter (WordPress plugin) | The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action. | high | 7.5 | 1% |
| CVE-2017-18592 | woocommerce-catalog-enquiry (WordPress plugin) | The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads. | high | 7.5 | 1% |
| CVE-2018-20988 | wpgform (WordPress plugin) | The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation. | high | 7.5 | 1% |