Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-6267 | easy-redirect-manager (WordPress plugin) | The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log vie | medium | 6.1 | 1% |
| CVE-2019-16250 | ocean-extra (WordPress plugin) | includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a C | high | 7.5 | 1% |
| CVE-2019-17229 | motors-car-dealership-classified-listings (WordPress plugin) | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for Wo | medium | 6.1 | 1% |
| CVE-2022-0743 | getgrav/grav | Cross site scripting in getgrav/grav | medium | 4.6 | 1% |
| CVE-2021-24458 | popup-box (WordPress plugin) | The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or valida | high | 8.8 | 1% |
| CVE-2021-24459 | survey-maker (WordPress plugin) | The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby | high | 8.8 | 1% |
| CVE-2021-24460 | popup-box (WordPress plugin) | The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orde | high | 8.8 | 1% |
| CVE-2021-24461 | faq-builder (WordPress plugin) | The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before | high | 8.8 | 1% |
| CVE-2021-24462 | photo-gallery (WordPress plugin) | The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4. | high | 8.8 | 1% |
| CVE-2021-24463 | image-slider (WordPress plugin) | The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or | high | 8.8 | 1% |
| CVE-2021-24506 | slider-hero (WordPress plugin) | The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of | high | 8.8 | 1% |
| CVE-2021-24580 | side-menu (WordPress plugin) | The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in S | high | 8.8 | 1% |
| CVE-2022-29248 | guzzlehttp/guzzle, drupal/core | Cross-domain cookie leakage in Guzzle | high | 8.0 | 1% |
| CVE-2020-25630 | moodle/moodle | Moodle Denial of Service | high | 7.5 | 1% |
| CVE-2012-1589 | drupal/drupal | Drupal Open Redirect | medium | 0.0 | 1% |
| CVE-2026-21450 | bagisto/bagisto | Bagisto SSTI vulnerability in type parameter can lead to RCE | high | 0.0 | 1% |
| CVE-2020-29553 | getgrav/grav | Grav CMS Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2021-24575 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before usi | high | 8.8 | 1% |
| CVE-2021-24748 | email-before-download (WordPress plugin) | The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before usin | high | 8.8 | 1% |
| CVE-2021-24755 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQ | high | 8.8 | 1% |
| CVE-2021-24829 | visitor-traffic-real-time-statistics (WordPress plugin) | The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_ind | high | 8.8 | 1% |
| CVE-2021-24846 | ni-woocommerce-custom-order-status (WordPress plugin) | The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, ava | high | 8.8 | 1% |
| CVE-2021-24847 | seo-redirection-301-redirect-manager (WordPress plugin) | The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any aut | high | 8.8 | 1% |
| CVE-2021-24848 | mediamatic (WordPress plugin) | The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not | high | 8.8 | 1% |
| CVE-2020-7759 | pimcore/pimcore | SQL Injection in pimcore | high | 7.2 | 1% |
| CVE-2021-24692 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web ser | medium | 6.5 | 1% |
| CVE-2021-20281 | moodle/moodle | Moodle allowed some users without permission to view other users' full names | medium | 5.3 | 1% |
| CVE-2019-16194 | centreon/centreon | SQL injection in Centreon | critical | 9.8 | 1% |
| CVE-2019-7357 | intelliants/subrion | Subrion CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2024-23119 | centreon/centreon | Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability | high | 8.8 | 1% |
| CVE-2016-3165 | drupal/core, drupal/drupal | Drupal Form API ignores access restrictions on submit buttons | high | 7.5 | 1% |
| CVE-2021-32711 | shopware/platform | Exposure of Sensitive Information to an Unauthorized Actor | critical | 9.1 | 1% |
| CVE-2022-2921 | notrinos/notrinos-erp | Exposure of password hashes in notrinos/notrinos-erp | high | 8.8 | 1% |
| CVE-2017-7620 | mantisbt/mantisbt | MantisBT vulnerable to CSRF and Open Redirect attacks | medium | 6.5 | 1% |
| CVE-2021-25075 | duplicate-page-or-post (WordPress plugin) | The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplica | low | 3.5 | 1% |
| CVE-2022-24833 | privatebin/privatebin | Persistent Cross-site Scripting vulnerability in PrivateBin | high | 8.2 | 1% |
| CVE-2024-52293 | craftcms/cms | Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI | high | 7.2 | 1% |
| CVE-2023-2546 | wp-user-switch (WordPress plugin) | The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incor | high | 8.8 | 1% |
| CVE-2024-27923 | getgrav/grav | Remote Code Execution by uploading a phar file using frontmatter | high | 8.8 | 1% |
| CVE-2022-1123 | leaflet-maps-marker (WordPress plugin) | The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters be | high | 7.2 | 1% |
| CVE-2014-9414 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross | medium | 6.8 | 1% |
| CVE-2008-5113 | WordPress core | WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to condu | medium | 4.0 | 1% |
| CVE-2022-3463 | contact-form (WordPress plugin) | The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a | critical | 9.8 | 1% |
| CVE-2015-7503 | zendframework/zend-crypt, zendframework/zendframework | Zend Framework Information Disclosure | high | 7.5 | 1% |
| CVE-2019-12470 | mediawiki/core | Wikimedia MediaWik exposed suppressed log in RevisionDelete page | medium | 6.5 | 1% |
| CVE-2019-12149 | silverstripe/registry, silverstripe/restfulserver | silverstripe restfulserver and registry modules SQL injection vulnerability | critical | 9.8 | 1% |
| CVE-2020-13485 | verbb/knock-knock | Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header | critical | 9.1 | 1% |
| CVE-2020-9335 | photo-gallery (WordPress plugin) | Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnera | medium | 4.8 | 1% |
| CVE-2014-3542 | moodle/moodle | Moodle allows remote attackers to read arbitrary files | medium | 0.0 | 1% |
| CVE-2014-3543 | moodle/moodle | Moodle Arbitrary File Read via XML External Entity vulnerability | medium | 0.0 | 1% |