Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-7433 | better-wp-security (WordPress plugin) | The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page. | high | 7.5 | 1% |
| CVE-2018-16967 | wp-file-manager (WordPress plugin) | There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parame | medium | 6.1 | 1% |
| CVE-2019-14790 | limb-gallery (WordPress plugin) | The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=short | medium | 6.1 | 1% |
| CVE-2019-9913 | live-chat (WordPress plugin) | The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS. | medium | 6.1 | 1% |
| CVE-2021-39339 | telefication (WordPress plugin) | The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-suppli | medium | 5.8 | 1% |
| CVE-2018-12642 | froxlor/froxlor | Froxlor Incorrect Access Control | high | 7.5 | 1% |
| CVE-2022-0282 | microweber/microweber | Code Injection in microweber | high | 7.5 | 1% |
| CVE-2022-2352 | post-smtp (WordPress plugin) | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high | high | 7.2 | 1% |
| CVE-2019-13505 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. | medium | 6.1 | 1% |
| CVE-2020-6850 | miniorange-saml-20-single-sign-on (WordPress plugin) | Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-l | medium | 6.1 | 1% |
| CVE-2022-2473 | wp-useronline (WordPress plugin) | The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in ver | medium | 5.5 | 1% |
| CVE-2020-35942 | nextgen-gallery (WordPress plugin) | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusi | high | 8.8 | 1% |
| CVE-2021-24447 | wp-image-zoom (WordPress plugin) | The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to | medium | 5.3 | 1% |
| CVE-2025-0924 | wp-security-audit-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and | high | 7.2 | 1% |
| CVE-2016-11011 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation. | medium | 6.5 | 1% |
| CVE-2021-41824 | craftcms/cms | CSV Injection Vulnerability | high | 8.8 | 1% |
| CVE-2022-3300 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, | high | 7.2 | 1% |
| CVE-2015-9456 | orbisius-child-theme-creator (WordPress plugin) | The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin | medium | 6.5 | 1% |
| CVE-2020-10803 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection vulnerability | medium | 5.4 | 1% |
| CVE-2022-2593 | better-search-replace (WordPress plugin) | The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL quer | high | 7.2 | 1% |
| CVE-2011-3744 | ezyang/htmlpurifier | HTML Purifier allows remote attackers to obtain sensitive information | medium | 5.3 | 1% |
| CVE-2026-55224 | mineadmin/mineadmin | MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall | high | 0.0 | 1% |
| CVE-2021-24754 | mainwp-child-reports (WordPress plugin) | The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement | high | 7.2 | 1% |
| CVE-2015-1000004 | filedownload (WordPress plugin) | XSS in filedownload v1.4 wordpress plugin | medium | 6.1 | 1% |
| CVE-2020-7239 | conversation-watson (WordPress plugin) | The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing | medium | 6.1 | 1% |
| CVE-2010-3094 | drupal/drupal | Drupal cross-site scripting vulnerability via actions feature and trigger module | low | 0.0 | 1% |
| CVE-2024-3962 | woocommerce-product-addon (WordPress plugin) | The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.8 | 1% |
| CVE-2023-6528 | slider-revolution (WordPress plugin) | The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary conte | high | 8.8 | 1% |
| CVE-2021-24213 | givewp (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulner | medium | 6.1 | 1% |
| CVE-2008-4104 | joomla/framework | Joomla! Open Redirect vulnerability | medium | 0.0 | 1% |
| CVE-2011-3583 | typo3/cms | Typo3 SQL injection due to faulty prepared statements | critical | 9.8 | 1% |
| CVE-2024-13725 | infusionsoft-official-opt-in-forms (WordPress plugin) | The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via th | critical | 9.8 | 1% |
| CVE-2019-12245 | silverstripe/assets, silverstripe/framework | Lack of access control on upoaded files | medium | 5.3 | 1% |
| CVE-2012-5890 | sjbr/sr-feuser-register | Front End User Registration (sr_feuser_register) extension for TYPO3 allows remote attackers to obtain user names, passwords | medium | 0.0 | 1% |
| CVE-2020-14063 | tc-custom-javascript (WordPress plugin) | A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remot | medium | 6.1 | 1% |
| CVE-2021-39189 | pimcore/pimcore | Observable Response Discrepancy in Lost Password Service | medium | 5.3 | 1% |
| CVE-2022-4950 | cool-timeline (WordPress plugin), cryptocurrency-payment-\&-donation-box (WordPress plugin), cryptocurrency-widgets (WordPress plugin) +7 more | Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote c | high | 8.8 | 1% |
| CVE-2022-39357 | wintercms/winter | Prototype pollution in Snowboard framework | high | 8.1 | 1% |
| CVE-2023-6558 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validat | high | 7.2 | 1% |
| CVE-2023-3566 | wallabag/wallabag | Wallabag vulnerable to Allocation of Resources Without Limits or Throttling | medium | 6.5 | 1% |
| CVE-2015-9420 | soundcloud-is-gold (WordPress plugin) | The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter. | medium | 6.1 | 1% |
| CVE-2015-9430 | crazy-bone (WordPress plugin) | The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header. | medium | 6.1 | 1% |
| CVE-2016-10984 | echosign (WordPress plugin) | The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. | medium | 6.1 | 1% |
| CVE-2016-10985 | echosign (WordPress plugin) | The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. | medium | 6.1 | 1% |
| CVE-2016-10986 | tweet-wheel (WordPress plugin) | The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret. | medium | 6.1 | 1% |
| CVE-2016-10987 | persian-woocommerce-sms (WordPress plugin) | The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS. | medium | 6.1 | 1% |
| CVE-2016-10988 | leenkme (WordPress plugin) | The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description | medium | 6.1 | 1% |
| CVE-2018-17583 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action. | medium | 6.1 | 1% |
| CVE-2018-17585 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLangua | medium | 6.1 | 1% |
| CVE-2018-17586 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action. | medium | 6.1 | 1% |