Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-3124 | simplesamlphp/simplesamlphp | SimpleSAMLphp Information leakage issue in the sanitycheck module | medium | 5.3 | 1% |
| CVE-2020-18155 | intelliants/subrion | SQL Injection in Subrion CMS | critical | 9.8 | 1% |
| CVE-2019-18887 | symfony/http-kernel, symfony/symfony | Symfony Http-Kernel has non-constant time comparison in UriSigner | high | 8.1 | 1% |
| CVE-2021-24345 | sendit (WordPress plugin) | The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sani | medium | 6.6 | 1% |
| CVE-2015-2308 | symfony/http-kernel, symfony/symfony | Symfony Vulnerable to PHP Eval Injection | medium | 0.0 | 1% |
| CVE-2021-24717 | automatorwp (WordPress plugin) | The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate autom | high | 8.8 | 1% |
| CVE-2019-11514 | flarum/flarum | Flarum mishandles invalidation of user email tokens | high | 7.5 | 1% |
| CVE-2016-15041 | mainwp-dashboard (WordPress plugin) | The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Sit | high | 7.2 | 1% |
| CVE-2022-1583 | external-links-in-new-window-\/-new-tab (WordPress plugin) | The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to externa | medium | 6.5 | 1% |
| CVE-2025-66301 | getgrav/grav | Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions | high | 0.0 | 1% |
| CVE-2021-32649 | october/system | October/System authenticated file write leads to remote code execution | high | 8.8 | 1% |
| CVE-2019-17550 | blog2social (WordPress plugin) | The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute a | medium | 6.1 | 1% |
| CVE-2022-0429 | wp-cerber-security\,-anti-spam-\&-malware-scan (WordPress plugin) | The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an att | medium | 6.1 | 1% |
| CVE-2021-24973 | site-reviews (WordPress plugin) | The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (avai | medium | 6.1 | 1% |
| CVE-2021-24606 | availability-calendar (WordPress plugin) | The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL s | high | 8.8 | 1% |
| CVE-2021-24669 | maz-loader (WordPress plugin) | The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortc | high | 8.8 | 1% |
| CVE-2021-24758 | email-log (WordPress plugin) | The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before | high | 8.8 | 1% |
| CVE-2021-24835 | frontend-manager-for-woocommerce-along-with-bookings-subscription-listings-compatible (WordPress plugin) | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used i | high | 8.8 | 1% |
| CVE-2022-1037 | exmage (WordPress plugin) | The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF iss | high | 7.2 | 1% |
| CVE-2021-24975 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting t | medium | 6.1 | 1% |
| CVE-2015-9404 | neuvoo-jobroll (WordPress plugin) | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. | medium | 6.1 | 1% |
| CVE-2014-6292 | in2code/femanager | TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users | medium | 0.0 | 1% |
| CVE-2021-36787 | in2code/femanager | Cross-site Scripting in the femanager TYPO3 extension | medium | 0.0 | 1% |
| CVE-2026-52824 | kimai/kimai | Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover | critical | 0.0 | 1% |
| CVE-2014-10388 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure. | medium | 5.3 | 1% |
| CVE-2016-10929 | advanced-ajax-page-loader (WordPress plugin) | The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in. | medium | 5.3 | 1% |
| CVE-2015-9337 | profile-builder (WordPress plugin) | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. | high | 7.5 | 1% |
| CVE-2016-0796 | mb.miniaudioplayer (WordPress plugin) | WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and | high | 7.5 | 1% |
| CVE-2023-5939 | rtmedia (WordPress plugin) | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, | high | 7.2 | 1% |
| CVE-2021-34638 | download-manager (WordPress plugin) | Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive conf | medium | 6.5 | 1% |
| CVE-2015-9273 | slimstat-analytics (WordPress plugin) | The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated w | medium | 6.1 | 1% |
| CVE-2019-14364 | email-subscribers (WordPress plugin) | An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript c | medium | 6.1 | 1% |
| CVE-2022-2627 | newspaper (WordPress plugin) | The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, lea | medium | 6.1 | 1% |
| CVE-2021-25064 | wow-countdowns (WordPress plugin) | The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, lead | high | 7.2 | 1% |
| CVE-2021-24775 | document-embedder (WordPress plugin) | The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title | medium | 5.3 | 1% |
| CVE-2022-30597 | moodle/moodle | External Control of Assumed-Immutable Web Parameter in moodle | medium | 5.3 | 1% |
| CVE-2021-27672 | tribalsystems/zenario | SQL Injection in tribalsystems/zenario | medium | 4.9 | 1% |
| CVE-2026-45140 | chamilo/chamilo-lms | Chamilo LMS CStudio upload flow allows unauthenticated remote code execution | critical | 9.8 | 1% |
| CVE-2017-18545 | invite-anyone (WordPress plugin) | The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input. | high | 7.5 | 1% |
| CVE-2021-24188 | wp-content-copy-protection-\&-no-right-click (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click Wo | high | 8.8 | 1% |
| CVE-2021-24189 | captchinoo (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login p | high | 8.8 | 1% |
| CVE-2021-24190 | conditional-marketing-mailer (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordP | high | 8.8 | 1% |
| CVE-2021-24192 | sitemap (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to i | high | 8.8 | 1% |
| CVE-2021-24193 | visitor-traffic-real-time-statistics (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress | high | 8.8 | 1% |
| CVE-2021-24194 | login-protection---limit-failed-login-attempts (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts | high | 8.8 | 1% |
| CVE-2021-24195 | login-as-user-or-customer-\(user-switching\) (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) Wor | high | 8.8 | 1% |
| CVE-2019-12472 | mediawiki/core | MediaWiki Incorrect Access Control vulnerability | high | 7.5 | 1% |
| CVE-2021-41268 | symfony/security-bundle, symfony/symfony | Cookie persistence after password changes in symfony/security-bundle | medium | 6.5 | 1% |
| CVE-2024-22640 | tecnickcom/tcpdf | TCPDF vulnerable to Regular Expression Denial of Service | medium | 0.0 | 1% |
| CVE-2018-9864 | wp-live-chat-support (WordPress plugin) | The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field. | medium | 6.1 | 1% |