Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-30134 | php-mod/curl | php-mod/curl allows Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2024-0590 | microsoft-clarity (WordPress plugin) | The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is | medium | 6.1 | 1% |
| CVE-2017-9420 | spiffy-calendar (WordPress plugin) | Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 1% |
| CVE-2018-1000826 | microweber/microweber | Microweber XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2019-9567 | forminator (WordPress plugin) | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll. | medium | 6.1 | 1% |
| CVE-2022-23064 | snipe/snipe-it | snipe-IT vulnerable to host header injection | high | 8.8 | 1% |
| CVE-2021-25086 | advanced-page-visit-counter (WordPress plugin) | The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashb | medium | 6.1 | 1% |
| CVE-2015-9391 | yawpp (WordPress plugin) | The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter. | medium | 6.1 | 1% |
| CVE-2020-25629 | moodle/moodle | Moodle incorrect access control | high | 8.8 | 1% |
| CVE-2020-6849 | marketo-forms-and-tracking (WordPress plugin) | The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS. | high | 8.8 | 1% |
| CVE-2021-24689 | contact-form (WordPress plugin) | The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files | medium | 4.9 | 1% |
| CVE-2021-39217 | openmage/magento-lts | Fix for arbitrary command execution in custom layout update through blocks | high | 7.2 | 1% |
| CVE-2021-20841 | ec-cube/ec-cube | EC-CUBE Improper access control in Management screen | medium | 6.5 | 1% |
| CVE-2021-24952 | conversios (WordPress plugin) | The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_p | high | 8.8 | 1% |
| CVE-2021-25054 | wpcalc (WordPress plugin) | The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an | high | 8.8 | 1% |
| CVE-2022-0410 | visitor-statistics (WordPress plugin) | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a | high | 8.8 | 1% |
| CVE-2022-22735 | simple-quotation (WordPress plugin) | The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lack | high | 8.8 | 1% |
| CVE-2017-1000419 | phpbb/phpbb | phpBB Server-Side Request Forgery (SSRF) | high | 7.5 | 1% |
| CVE-2019-10154 | moodle/moodle | Moodle all messaging conversations could be viewed | high | 7.5 | 1% |
| CVE-2015-9472 | incoming-links (WordPress plugin) | The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header. | medium | 6.1 | 1% |
| CVE-2020-5392 | wp-auth0 (WordPress plugin) | A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page. | medium | 6.1 | 1% |
| CVE-2020-6753 | login-by-auth0 (WordPress plugin) | The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392. | medium | 6.1 | 1% |
| CVE-2020-9466 | export-users-to-csv (WordPress plugin) | The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection. | medium | 6.1 | 1% |
| CVE-2022-2958 | badgos (WordPress plugin) | The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions ava | high | 8.8 | 1% |
| CVE-2022-3494 | complianz (WordPress plugin) | The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL | high | 8.8 | 1% |
| CVE-2022-42344 | magento/community-edition | Magento Improper input validation vulnerability | high | 8.8 | 1% |
| CVE-2021-24774 | check-\&-log-email (WordPress plugin) | The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them | high | 7.2 | 1% |
| CVE-2021-24860 | bsk-pdf-manager (WordPress plugin) | The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL s | high | 7.2 | 1% |
| CVE-2021-24861 | quotes-collection (WordPress plugin) | The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement | high | 7.2 | 1% |
| CVE-2021-24889 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privile | high | 7.2 | 1% |
| CVE-2020-7776 | phpoffice/phpexcel, phpoffice/phpspreadsheet | Cross-site scripting in phpoffice/phpspreadsheet | medium | 6.4 | 1% |
| CVE-2021-20282 | moodle/moodle | Moodle Bypass email verification secret when confirming account registration | medium | 5.3 | 1% |
| CVE-2024-13545 | ultimate-bootstrap-elements-for-elementor (WordPress theme) | The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path pa | critical | 9.8 | 1% |
| CVE-2021-24566 | fox---currency-switcher-professional-for-woocommerce (WordPress plugin) | The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode. | high | 8.8 | 1% |
| CVE-2021-24858 | wp-cookie-user-info (WordPress plugin) | The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL s | high | 7.2 | 1% |
| CVE-2021-23340 | pimcore/pimcore | Path traversal in pimcore/pimcore | high | 7.1 | 1% |
| CVE-2015-7672 | centreon/centreon | Centreon Cross-site Scripting Vulnerability | medium | 5.4 | 1% |
| CVE-2022-1421 | discy (WordPress plugin) | The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary | medium | 4.3 | 1% |
| CVE-2023-25313 | wwbn/avideo | AVideo contains Command injection when embedding a video link | critical | 9.6 | 1% |
| CVE-2020-21174 | feehi/cms | liufee CMS File Upload vulnerability | critical | 9.8 | 1% |
| CVE-2020-21489 | feehi/cms | Liufee CMS File Upload vulnerability | critical | 9.8 | 1% |
| CVE-2023-5250 | grid-plus (WordPress plugin) | The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.3 via a shortcode attribute. | high | 8.8 | 1% |
| CVE-2016-5705 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-43138 | dolibarr/dolibarr | Dolibarr vulnerable to privilege escalation | critical | 9.8 | 1% |
| CVE-2022-25602 | responsive-menu (WordPress plugin) | Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPr | high | 8.3 | 1% |
| CVE-2023-6559 | mw-wp-form (WordPress plugin) | The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the | high | 7.5 | 1% |
| CVE-2022-4489 | husky---products-filter-professional-for-woocommerce (WordPress plugin) | The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as ad | high | 7.2 | 1% |
| CVE-2021-29504 | wp-cli/wp-cli | Improper Certificate Validation in WP-CLI framework | critical | 9.1 | 1% |
| CVE-2021-24942 | menu-item-visibility-control (WordPress plugin) | The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu | high | 7.2 | 1% |
| CVE-2023-24676 | processwire/processwire | Arbitrary Code Execution in Processwire | high | 7.2 | 1% |