Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-12697 | directmailteam/direct-mail | Denial of service in direct_mail | medium | 5.3 | 1% |
| CVE-2024-21546 | unisharp/laravel-filemanager | UniSharp Laravel Filemanager Code Injection vulnerability | critical | 9.8 | 1% |
| CVE-2021-24191 | coming-soon-page-\&-maintenance-mode (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction | high | 8.8 | 1% |
| CVE-2018-20962 | backpack/crud | Backpack\CRUD for Laravel XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2019-25142 | materialis (WordPress plugin), mesmerize (WordPress plugin) | The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesm | high | 8.8 | 1% |
| CVE-2018-1000025 | kreait/firebase-php | Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability | high | 8.1 | 1% |
| CVE-2022-0255 | database-backup (WordPress plugin) | The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL | high | 7.2 | 1% |
| CVE-2022-0887 | easy-social-icons (WordPress plugin) | The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an | high | 7.2 | 1% |
| CVE-2022-34149 | wp-oauth-server (WordPress plugin) | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. | critical | 9.8 | 1% |
| CVE-2023-3295 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing | high | 8.8 | 1% |
| CVE-2021-24441 | sign-up-sheets (WordPress plugin) | The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which | high | 8.0 | 1% |
| CVE-2020-36176 | better-wp-security (WordPress plugin) | The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an exis | high | 7.5 | 1% |
| CVE-2014-3944 | typo3/cms | TYPO3 Improper Session Invalidation | medium | 0.0 | 1% |
| CVE-2017-14238 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in admin/menus/edit.php | critical | 9.8 | 1% |
| CVE-2017-14242 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in don/list.php | critical | 9.8 | 1% |
| CVE-2024-20719 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Scripting (XSS) | critical | 9.1 | 1% |
| CVE-2019-17515 | cleantalk-spam-protect (WordPress plugin) | The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows a | medium | 6.1 | 1% |
| CVE-2015-5341 | moodle/moodle | Moodle allows attackers to read SCORM contents | medium | 4.3 | 1% |
| CVE-2022-1187 | wp-youtube-live (WordPress plugin) | The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which a | medium | 6.1 | 1% |
| CVE-2023-5546 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2010-5103 | typo3/cms | TYPO3 SQL Injection vulnerability | medium | 0.0 | 1% |
| CVE-2017-14498 | silverstripe/cms | Silverstripe CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2018-18379 | elementor-page-builder (WordPress plugin) | The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2021-24350 | visitors-online (WordPress plugin) | The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin woul | medium | 6.1 | 1% |
| CVE-2025-47226 | snipe/snipe-it | Grokability Snipe-IT has incorrect authorization for accessing asset information | medium | 5.0 | 1% |
| CVE-2024-10898 | cf7-email-add-on (WordPress plugin) | The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the | high | 8.8 | 1% |
| CVE-2025-1361 | ip2location-country-blocker (WordPress plugin) | The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.3 | high | 7.5 | 1% |
| CVE-2020-15005 | mediawiki/core | img_auth.php may leak private extension images into the public cache | medium | 0.0 | 1% |
| CVE-2023-2499 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to | critical | 9.8 | 1% |
| CVE-2024-11028 | multimanager-wp (WordPress plugin) | The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up | critical | 9.8 | 1% |
| CVE-2024-0221 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, | critical | 9.1 | 1% |
| CVE-2023-0381 | gigpress (WordPress plugin) | The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statemen | high | 8.8 | 1% |
| CVE-2021-24777 | contact-form (WordPress plugin) | The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter whic | high | 7.2 | 1% |
| CVE-2021-25068 | sync-woocommerce-product-feed-to-google-shopping (WordPress plugin) | The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter which is not properly | high | 7.2 | 1% |
| CVE-2024-0679 | colormag (WordPress theme) | The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() func | medium | 6.5 | 1% |
| CVE-2025-23199 | librenms/librenms | LibreNMS Ports Stored Cross-site Scripting vulnerability | medium | 4.6 | 1% |
| CVE-2024-2242 | contact-form-7 (WordPress plugin) | The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to | medium | 6.1 | 1% |
| CVE-2024-11600 | borderless (WordPress plugin) | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execut | high | 7.2 | 1% |
| CVE-2018-16191 | ec-cube/ec-cube | EC-CUBE Open redirect vulnerability | medium | 6.1 | 1% |
| CVE-2022-0704 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2020-5255 | symfony/http-foundation, symfony/symfony | Prevent cache poisoning via a Response Content-Type header in Symfony | low | 2.6 | 1% |
| CVE-2022-0813 | phpmyadmin/phpmyadmin | Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin | high | 7.5 | 1% |
| CVE-2022-2269 | website-file-changes-monitor (WordPress plugin) | The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement vi | critical | 9.8 | 1% |
| CVE-2019-14797 | photo-gallery (WordPress plugin) | The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS. | medium | 5.4 | 1% |
| CVE-2021-41143 | openmage/magento-lts | Fix for arbitrary file deletion in customer media allows for remote code execution | high | 7.2 | 1% |
| CVE-2022-0190 | ad-invalid-click-protector (WordPress plugin) | The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action. | high | 8.8 | 1% |
| CVE-2021-24456 | quiz-maker (WordPress plugin) | The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQ | high | 7.2 | 1% |
| CVE-2022-2354 | wp-dbmanager (WordPress plugin) | The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite i | high | 7.2 | 1% |
| CVE-2021-25037 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an inter | medium | 6.5 | 1% |
| CVE-2015-3421 | eshop (WordPress plugin) | The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" | medium | 6.1 | 1% |