Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-21516 | feehi/cms | FeehiCMS has an arbitrary file upload vulnerability | critical | 9.8 | 1% |
| CVE-2017-12874 | simplesamlphp/simplesamlphp-module-infocard | SimpleSAMLphp InfoCard module Incorrect signature verification | high | 7.5 | 1% |
| CVE-2020-29471 | opencart/opencart | OpenCart Stored Cross-Site Scripting | medium | 4.8 | 1% |
| CVE-2022-25271 | drupal/core | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to impro | high | 7.5 | 1% |
| CVE-2013-7075 | typo3/cms | TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component | medium | 6.3 | 1% |
| CVE-2024-34111 | magento/community-edition | Magento Open Source Server-Side Request Forgery (SSRF) vulnerability | medium | 6.5 | 1% |
| CVE-2021-20280 | moodle/moodle | Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle | medium | 5.4 | 1% |
| CVE-2019-19849 | typo3/cms, typo3/cms-core | TYPO3 Insecure Deserialization in Query Generator & Query View | high | 8.8 | 1% |
| CVE-2022-39297 | melisplatform/melis-cms | melisplatform/melis-cms vulnerable to deserialization of untrusted data | high | 7.7 | 1% |
| CVE-2022-39298 | melisplatform/melis-front | melisplatform/melis-front vulnerable to deserialization of untrusted data | high | 7.7 | 1% |
| CVE-2023-6827 | essential-real-estate (WordPress plugin) | The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajax | high | 7.5 | 1% |
| CVE-2013-7073 | typo3/cms | TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component | medium | 6.5 | 1% |
| CVE-2018-5286 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page. | medium | 6.1 | 1% |
| CVE-2018-5292 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page. | medium | 6.1 | 1% |
| CVE-2018-5293 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page. | medium | 6.1 | 1% |
| CVE-2024-0250 | analytics-insights (WordPress plugin) | The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validati | medium | 6.1 | 1% |
| CVE-2021-32790 | woocommerce (WordPress plugin) | Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCo | medium | 4.9 | 1% |
| CVE-2012-5471 | moodle/moodle | Moodle Allows Unauthenticated Dropbox Access | medium | 0.0 | 1% |
| CVE-2020-15244 | openmage/magento-lts | RCE via PHP Object injection via SOAP Requests | high | 8.0 | 1% |
| CVE-2025-6586 | download-plugin (WordPress plugin) | The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_loc | high | 7.2 | 1% |
| CVE-2022-30999 | fof/upload | Possible cross-site scripting attack via unsanitized SVG files in FoF Upload | high | 8.7 | 1% |
| CVE-2019-12467 | mediawiki/core | MediaWiki Incorrect Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2020-15886 | munkireport/reportdata | MunkiReport reportdata module SQL injection vulnerability | high | 8.8 | 1% |
| CVE-2020-15887 | munkireport/softwareupdate | MunkiReport Software Update module is vulnerable to SQL injection | high | 8.8 | 1% |
| CVE-2022-1194 | mobile-events-manager (WordPress plugin) | The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid | high | 8.8 | 1% |
| CVE-2017-12946 | easy-modal (WordPress plugin) | classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, id | high | 7.2 | 1% |
| CVE-2017-12947 | easy-modal (WordPress plugin) | classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, | high | 7.2 | 1% |
| CVE-2022-0535 | e2pdf (WordPress plugin) | The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2022-36105 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to User Enumeration via Response Timing | medium | 5.3 | 1% |
| CVE-2023-1080 | gn-publisher (WordPress plugin) | The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and includi | medium | 6.1 | 1% |
| CVE-2018-19620 | showdoc/showdoc | Showdoc Unauthenticated Access | medium | 4.3 | 1% |
| CVE-2021-3985 | kevinpapst/kimai2 | kimai2 is vulnerable to Cross-site Scripting | high | 8.0 | 1% |
| CVE-2022-43497 | WordPress core | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scri | medium | 6.1 | 1% |
| CVE-2024-8289 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-e | critical | 9.8 | 1% |
| CVE-2019-8127 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SQLi Vulnerability | high | 8.8 | 1% |
| CVE-2022-1472 | better-find-and-replace (WordPress plugin) | The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using th | high | 7.2 | 1% |
| CVE-2018-14430 | multi-step-form (WordPress plugin) | The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data | medium | 6.1 | 1% |
| CVE-2022-31050 | typo3/cms, typo3/cms-core | Insufficient Session Expiration in TYPO3's Admin Tool | medium | 6.0 | 1% |
| CVE-2019-10643 | contao/contao, contao/core-bundle | Contao Does Not Expire Tokens Correctly | critical | 9.8 | 1% |
| CVE-2023-6743 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all ve | high | 8.8 | 1% |
| CVE-2021-37626 | contao/contao, contao/core-bundle | PHP file inclusion via insert tags | medium | 6.7 | 1% |
| CVE-2022-1555 | microweber/microweber | Microweber vulnerable to cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2023-5952 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perfor | critical | 9.8 | 1% |
| CVE-2019-7871 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Unsafe File Upload | high | 8.8 | 1% |
| CVE-2024-52291 | craftcms/cms | Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution | high | 8.4 | 1% |
| CVE-2022-33969 | flipbox (WordPress plugin) | Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress. | high | 7.2 | 1% |
| CVE-2022-36375 | responsive-tabs (WordPress plugin) | Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress. | high | 7.2 | 1% |
| CVE-2021-24181 | tutor-lms (WordPress plugin) | The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vul | medium | 6.5 | 1% |
| CVE-2021-24185 | tutor-lms (WordPress plugin) | The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to | medium | 6.5 | 1% |
| CVE-2021-24186 | tutor-lms (WordPress plugin) | The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin | medium | 6.5 | 1% |