Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-9911 | social-networks-auto-poster (WordPress plugin) | The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edi | medium | 6.1 | 1% |
| CVE-2022-2713 | aheinze/cockpit | Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration | critical | 9.8 | 1% |
| CVE-2023-41879 | openmage/magento-lts | Magento LTS's guest order "protect code" can be brute-forced too easily | high | 7.5 | 1% |
| CVE-2022-24743 | sylius/sylius | Insufficient Session Expiration in Sylius | high | 7.1 | 1% |
| CVE-2016-10994 | truemag-theme (WordPress theme) | The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter. | medium | 6.1 | 1% |
| CVE-2023-0968 | watu (WordPress plugin) | The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dn’, 'email', 'points', and 'date' parameters in | medium | 6.1 | 1% |
| CVE-2021-24677 | find-my-blocks (WordPress plugin) | The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users | medium | 5.3 | 1% |
| CVE-2024-6846 | chatbot-with-chatgpt (WordPress plugin) | The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to | medium | 5.3 | 1% |
| CVE-2021-24501 | workreap (WordPress plugin) | The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perf | high | 8.1 | 1% |
| CVE-2022-0403 | library-file-manager (WordPress plugin) | The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by | high | 8.1 | 1% |
| CVE-2013-4693 | digital-flash-clock (WordPress plugin) | WordPress Xorbin Digital Flash Clock 1.0 has XSS | medium | 6.1 | 1% |
| CVE-2023-5640 | article-analytics (WordPress plugin) | The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX acti | critical | 9.8 | 1% |
| CVE-2022-1176 | remdex/livehelperchat | Type Confusion in LiveHelperChat | high | 7.5 | 1% |
| CVE-2017-12867 | simplesamlphp/simplesamlphp | SimpleSAMLphp Invalid token creation and validation | medium | 5.9 | 1% |
| CVE-2008-4524 | adaptcms/adaptcms | AdaptCMS SQL Injection vulnerability | high | 0.0 | 1% |
| CVE-2011-4782 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2024-12877 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | critical | 9.8 | 1% |
| CVE-2015-4697 | google-analyticator (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563. | high | 8.8 | 1% |
| CVE-2021-24161 | responsive-menu (WordPress plugin) | In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploadi | high | 8.8 | 1% |
| CVE-2022-41922 | yiisoft/yii | Prevent RCE when deserializing untrusted user input | high | 8.1 | 1% |
| CVE-2014-100001 | liveoptim (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers t | medium | 6.8 | 1% |
| CVE-2019-12517 | slickquiz (WordPress plugin) | An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-a | medium | 6.1 | 1% |
| CVE-2019-19982 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to | medium | 5.3 | 1% |
| CVE-2020-36503 | connections-business-directory (WordPress plugin) | The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a | high | 8.0 | 1% |
| CVE-2023-2733 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insuffici | critical | 9.8 | 1% |
| CVE-2022-3395 | wp-all-export (WordPress plugin) | The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing us | high | 8.8 | 1% |
| CVE-2023-5340 | five-star-restaurant-menu (WordPress plugin) | The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unaut | critical | 9.8 | 1% |
| CVE-2024-38529 | admidio/admidio | Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment | critical | 9.0 | 1% |
| CVE-2021-39170 | pimcore/pimcore | Improper Encoding or Escaping of Output in Asset Metadata Component | high | 8.0 | 1% |
| CVE-2022-29858 | silverstripe/assets | Unpublished, protected files can be published via shortcode | medium | 4.3 | 1% |
| CVE-2017-6099 | paypal/merchant-sdk-php | PayPal PHP Merchant SDK Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2023-1119 | srbtranslatin (WordPress plugin), wp-optimize (WordPress plugin) | The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escap | medium | 6.1 | 1% |
| CVE-2024-1247 | concrete5/concrete5 | Concrete CMS vulnerable to stored XSS via the Role Name field | low | 2.0 | 1% |
| CVE-2025-54138 | librenms/librenms | LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE | high | 7.5 | 1% |
| CVE-2025-6085 | integromat-connector (WordPress plugin) | The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_med | high | 7.2 | 1% |
| CVE-2017-2642 | moodle/moodle | Moodle User fullname disclosure on user preferences page | medium | 6.5 | 1% |
| CVE-2019-14315 | sunhater/kcfinder | SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php | medium | 6.1 | 1% |
| CVE-2021-24429 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointmen | medium | 6.1 | 1% |
| CVE-2015-7386 | gallery---photo-albums---portfolio (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for Wo | low | 3.5 | 1% |
| CVE-2022-0777 | microweber/microweber | Rate limit missing in microweber | high | 7.5 | 1% |
| CVE-2012-3384 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentica | medium | 6.8 | 1% |
| CVE-2021-24839 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allo | high | 7.5 | 1% |
| CVE-2022-1762 | iq-block-country (WordPress plugin) | The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowi | high | 7.5 | 1% |
| CVE-2022-1801 | very-simple-contact-form (WordPress plugin) | The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden i | high | 7.5 | 1% |
| CVE-2017-6216 | novaksolutions/infusionsoft-php-sdk | infusionsoft-php-sdk reflected Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2017-6217 | paypal/adaptivepayments-sdk-php | paypal/adaptivepayments-sdk-php vulnerable to a reflected XSS | medium | 6.1 | 1% |
| CVE-2012-3522 | geshi/geshi | GeSHi vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2019-8136 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Insecure Component | critical | 9.8 | 1% |
| CVE-2021-4346 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This i | critical | 9.8 | 1% |
| CVE-2009-3818 | sjbr/sr-freecap | freeCap CAPTCHA extension for TYPO3 has vulnerability in the session handling feature | medium | 0.0 | 1% |