Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-25702 | moodle/moodle | Cross-site Scripting (XSS) in moodle | medium | 6.1 | 1% |
| CVE-2022-1051 | wpqa-builder (WordPress plugin) | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the c | medium | 5.4 | 1% |
| CVE-2020-25813 | mediawiki/core | MediaWiki Special:UserRights exposes the existence of hidden users | medium | 5.3 | 1% |
| CVE-2018-1135 | moodle/moodle | Moodle Portfolio forum caller class allows a user to download any file | medium | 6.5 | 1% |
| CVE-2020-8426 | elementor (WordPress plugin) | The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be e | medium | 5.4 | 1% |
| CVE-2019-8093 | magento/community-edition, magento/product-community-edition | Magento Information Disclosure via File upload functionality | high | 8.8 | 1% |
| CVE-2020-13970 | shopware/platform | Shopware vulnerable to SSRF | high | 8.8 | 1% |
| CVE-2017-6930 | drupal/core, drupal/drupal | Drupal access bypass vulnerability | high | 8.1 | 1% |
| CVE-2022-0831 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2019-8158 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XML Injection | critical | 9.8 | 1% |
| CVE-2024-6823 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the m | high | 8.8 | 1% |
| CVE-2022-1585 | project-source-code-download (WordPress plugin) | The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which m | high | 7.5 | 1% |
| CVE-2020-15155 | baserproject/basercms | Cross Site Scripting(XSS) Vulnerability in Latest Release 4.3.6 Site basic settings | high | 7.3 | 1% |
| CVE-2019-12471 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-0899 | header-footer-code-manager (WordPress plugin) | The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an | medium | 6.1 | 1% |
| CVE-2008-0198 | wp-contactform (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and ea | medium | 4.3 | 1% |
| CVE-2012-1296 | elefant/cms | Elefant CMS Multiple XSS Vulnerabilities | medium | 0.0 | 1% |
| CVE-2013-5100 | jambagecom/div2007 | Static Methods since 2007 (div2007) extension for TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2013-5323 | sjbr/static-info-tables | Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2024-1205 | wemanage-app-worker (WordPress plugin) | The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulne | high | 8.8 | 1% |
| CVE-2024-9926 | jetpack (WordPress plugin) | The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subsc | medium | 4.3 | 1% |
| CVE-2021-24693 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, | critical | 9.0 | 1% |
| CVE-2022-34154 | enable-svg-webp-ico-upload (WordPress plugin) | Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 | high | 7.2 | 1% |
| CVE-2016-3729 | moodle/moodle | Moodle Improper Access Control | medium | 6.5 | 1% |
| CVE-2024-1986 | woocommerce-jetpack (WordPress plugin) | The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc | high | 8.8 | 1% |
| CVE-2022-1800 | export-any-wordpress-data-to-xml\/csv (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data bef | high | 7.2 | 1% |
| CVE-2023-38888 | dolibarr/dolibarr | Cross Site Scripting vulnerability in Dolibarr ERP CRM | critical | 9.6 | 1% |
| CVE-2023-6999 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, | high | 8.8 | 1% |
| CVE-2021-41267 | symfony/http-kernel, symfony/symfony | Webcache Poisoning in symfony/http-kernel | medium | 6.5 | 1% |
| CVE-2016-6608 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2017-14751 | wp-jobs (WordPress plugin) | The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field. | medium | 6.1 | 1% |
| CVE-2021-24877 | mainwp-child (WordPress plugin) | The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leadi | high | 7.2 | 1% |
| CVE-2010-3659 | typo3/cms-backend | TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms | medium | 5.4 | 1% |
| CVE-2022-34971 | feehi/cms | Feehi CMS arbitrary code execution via crafted PHP file | high | 8.8 | 1% |
| CVE-2015-5331 | moodle/moodle | Moodle improper access control | medium | 4.3 | 1% |
| CVE-2015-5342 | moodle/moodle | Moodle allows attackers to bypass intended access restrictions | medium | 4.3 | 1% |
| CVE-2023-46947 | intelliants/subrion | Subrion remote command execution vulnerability | high | 7.2 | 1% |
| CVE-2015-5339 | moodle/moodle | Moodle does not properly implement group-based access restrictions | medium | 4.3 | 1% |
| CVE-2015-5340 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 1% |
| CVE-2015-6535 | youtube-embed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remo | low | 3.5 | 1% |
| CVE-2020-13665 | drupal/core, drupal/drupal, drupal/core | Drupal Core Access bypass vulnerability | critical | 9.8 | 1% |
| CVE-2021-24778 | tradetracker-store (WordPress plugin) | The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before ins | high | 7.2 | 1% |
| CVE-2021-4208 | exportfeed (WordPress plugin) | The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statemen | high | 7.2 | 1% |
| CVE-2022-0267 | adrotate (WordPress plugin) | The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adro | high | 7.2 | 1% |
| CVE-2019-5884 | studio-42/elfinder | Sensitive Data Exposure in elFinder | medium | 5.9 | 1% |
| CVE-2026-52889 | verbb/formie | Formie Hidden field defaults vulnerable to Server-Side Template Injection | critical | 9.8 | 1% |
| CVE-2021-4337 | add-product-tabs (WordPress plugin), autopilot-seo (WordPress plugin), bulk-add-to-cart (WordPress plugin) +13 more | Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax | high | 8.8 | 1% |
| CVE-2022-1777 | filr (WordPress plugin) | The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any aut | high | 8.8 | 1% |
| CVE-2023-6636 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val | high | 7.2 | 1% |
| CVE-2023-6826 | e2pdf (WordPress plugin) | The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' funct | high | 7.2 | 1% |