Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-29297 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Neutralization of Special Elements Used | critical | 9.1 | 1% |
| CVE-2023-6985 | ai-assistant-by-10web (WordPress plugin) | The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 6.5 | 1% |
| CVE-2019-25152 | abandoned-cart-lite-for-woocommerce (WordPress plugin), abandoned-cart-pro-for-woocommerce (WordPress plugin) | The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scr | high | 7.2 | 1% |
| CVE-2017-15810 | popcashnet-code-integration-tool (WordPress plugin) | The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php. | medium | 6.1 | 1% |
| CVE-2017-6102 | rockhoist-badges-plugin (WordPress plugin) | Persistent XSS in wordpress plugin rockhoist-badges v1.2.2. | medium | 6.1 | 1% |
| CVE-2020-8436 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter. | medium | 6.1 | 1% |
| CVE-2022-3904 | monsterinsights (WordPress plugin) | The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauth | medium | 6.1 | 1% |
| CVE-2015-9476 | teardrop (WordPress theme) | The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates. | high | 8.8 | 1% |
| CVE-2015-9477 | vernissage (WordPress theme) | The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates. | high | 8.8 | 1% |
| CVE-2016-3167 | drupal/core, drupal/drupal | Drupal Open redirect vulnerability in the drupal_goto function | high | 7.4 | 1% |
| CVE-2013-5322 | bednee/cooluri | CoolURI extension for TYPO3 vulnerable to SQL Injection | high | 0.0 | 1% |
| CVE-2026-24788 | billz/raspap-webgui | RaspAP raspap-webgui contains an OS Command Injection vulnerability | high | 8.8 | 1% |
| CVE-2019-12331 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue | high | 8.8 | 1% |
| CVE-2020-25814 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2012-5368 | phpmyadmin/phpmyadmin | phpMyAdmin Unsafe Fetching of Javascript Code | medium | 0.0 | 1% |
| CVE-2022-0724 | microweber/microweber | Insecure Storage of Sensitive Information in Microweber | high | 0.0 | 1% |
| CVE-2023-0236 | tutor-lms (WordPress plugin) | The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back i | medium | 6.1 | 1% |
| CVE-2017-1000017 | phpmyadmin/phpmyadmin | phpMyAdmin SSRF in replication | high | 8.8 | 1% |
| CVE-2019-10671 | librenms/librenms | SQL Injection in LibreNMS | high | 8.8 | 1% |
| CVE-2019-12469 | mediawiki/core | MediaWiki Incorrect Access Control vulnerability | medium | 6.5 | 1% |
| CVE-2023-5414 | email-subscribers (WordPress plugin) | The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs | critical | 9.1 | 1% |
| CVE-2021-24957 | advanced-page-visit-counter (WordPress plugin) | The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the | high | 8.8 | 1% |
| CVE-2022-1182 | visual-slide-box-builder (WordPress plugin) | The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL stateme | high | 8.8 | 1% |
| CVE-2018-10363 | booking-calendar (WordPress plugin) | An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow | high | 7.5 | 1% |
| CVE-2020-25700 | moodle/moodle | SQL Injection in moodle | medium | 6.5 | 1% |
| CVE-2018-16285 | userpro (WordPress plugin) | The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/ad | medium | 6.1 | 1% |
| CVE-2021-24878 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wp | medium | 6.1 | 1% |
| CVE-2017-16842 | wordpress-seo (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPre | medium | 4.8 | 1% |
| CVE-2021-24484 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or | high | 7.2 | 1% |
| CVE-2021-24497 | giveaway (WordPress plugin) | The Giveaway WordPress plugin through 1.2.2 is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary | high | 7.2 | 1% |
| CVE-2019-15772 | nd-donations (WordPress plugin) | The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | medium | 6.1 | 1% |
| CVE-2019-15773 | nd-travel (WordPress plugin) | The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | medium | 6.1 | 1% |
| CVE-2019-15775 | nd-learning (WordPress plugin) | The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | medium | 6.1 | 1% |
| CVE-2019-15776 | simple-301-redirects-addon-bulk-uploader (WordPress plugin) | The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a C | medium | 6.1 | 1% |
| CVE-2021-24556 | email-subscriber (WordPress plugin) | The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and e | medium | 6.1 | 1% |
| CVE-2011-2674 | baserproject/basercms | BaserCMS privilege escallation | medium | 0.0 | 1% |
| CVE-2019-12934 | wp-code-highlightjs (WordPress plugin) | An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-j | high | 8.8 | 1% |
| CVE-2021-24662 | game-server-status (WordPress plugin) | The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, le | high | 7.2 | 1% |
| CVE-2021-24508 | smash-balloon-social-post-feed (WordPress plugin) | The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator | medium | 6.1 | 1% |
| CVE-2021-24756 | wp-system-log (WordPress plugin) | The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before | medium | 6.1 | 1% |
| CVE-2020-36731 | flexible-checkout-fields (WordPress plugin) | The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in add | high | 7.2 | 1% |
| CVE-2023-2252 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importin | low | 2.7 | 1% |
| CVE-2022-3600 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV inj | critical | 9.8 | 1% |
| CVE-2021-38312 | gutenberg-template-library-\&-redux-framework (WordPress plugin) | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoi | high | 7.1 | 1% |
| CVE-2021-24199 | wpdatatables (WordPress plugin) | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean- | medium | 6.5 | 1% |
| CVE-2021-24200 | wpdatatables (WordPress plugin) | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean- | medium | 6.5 | 1% |
| CVE-2016-9851 | phpmyadmin/phpmyadmin | phpMyAdmin Bypass logout timeout | medium | 5.3 | 1% |
| CVE-2020-26138 | silverstripe/framework | FormField with square brackets in field name skips validation | medium | 5.3 | 1% |
| CVE-2019-10641 | contao/contao, contao/core, contao/core-bundle | Contao Does Not Invalidate Existing Sessions When Password Changes | critical | 9.8 | 1% |
| CVE-2022-3302 | spam-protection\,-antispam\,-firewall (WordPress plugin) | The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statem | high | 7.2 | 1% |