Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-8121 | magento/community-edition, magento/product-community-edition | Using JS libraries with known security vulnerabilities | high | 0.0 | 1% |
| CVE-2021-24142 | 301-redirects (WordPress plugin) | Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" | high | 7.2 | 1% |
| CVE-2022-38104 | accordions-or-faqs (WordPress plugin) | Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari | high | 7.2 | 1% |
| CVE-2019-16523 | events-manager (WordPress plugin) | The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and inserti | medium | 5.4 | 1% |
| CVE-2017-1000194 | october/october | October CMS File Upload Vulnerability | critical | 9.8 | 1% |
| CVE-2021-24197 | wpdatatables (WordPress plugin) | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated us | high | 8.1 | 1% |
| CVE-2024-4442 | salon-booking-system (WordPress plugin) | The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is du | critical | 9.1 | 1% |
| CVE-2021-24964 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attack | medium | 6.1 | 1% |
| CVE-2024-11605 | wp-publications (WordPress plugin) | The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high p | medium | 4.8 | 1% |
| CVE-2024-1358 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the | high | 8.8 | 1% |
| CVE-2021-24831 | tab (WordPress plugin) | All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenti | high | 7.5 | 1% |
| CVE-2021-41231 | openmage/magento-lts | DataFlow upload remote code execution vulnerability | high | 7.2 | 1% |
| CVE-2024-2473 | wps-hide-login (WordPress plugin) | The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due t | medium | 5.3 | 1% |
| CVE-2022-2559 | fluent-support (WordPress plugin) | The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an | high | 7.2 | 1% |
| CVE-2021-24304 | newsmag (WordPress plugin) | The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthent | medium | 6.1 | 1% |
| CVE-2023-48648 | concrete5/concrete5 | Concrete CMS allows unauthorized access because directories can be created with insecure permissions | medium | 0.0 | 1% |
| CVE-2022-45982 | topthink/think | Deserialization of Untrusted Data in thinkphp | critical | 9.8 | 1% |
| CVE-2017-7489 | moodle/moodle | Moodle External blog editing takeover | medium | 6.3 | 1% |
| CVE-2017-12156 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2021-24994 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise | medium | 6.1 | 1% |
| CVE-2013-5750 | friendsofsymfony/user-bundle | FriendsOfSymfony FOSUserBundle denial of service via login form | medium | 0.0 | 1% |
| CVE-2023-7082 | export-any-wordpress-data-to-xml\/csv (WordPress plugin) | The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicl | high | 7.2 | 1% |
| CVE-2021-24138 | adrotate (WordPress plugin) | Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This require | medium | 5.5 | 1% |
| CVE-2022-0989 | ns-watermark-for-woocommerce (WordPress plugin) | An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide ma | high | 7.5 | 1% |
| CVE-2024-2782 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized | high | 7.5 | 1% |
| CVE-2024-11388 | dino-game (WordPress plugin) | The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu | medium | 6.4 | 1% |
| CVE-2019-3808 | moodle/moodle | Moodle XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-16774 | phpfastcache/phpfastcache | Object injection in cookie driver in phpfastcache | medium | 4.4 | 1% |
| CVE-2010-1630 | phpbb/phpbb | phpBB vulnerability related to use of "forum id" in circumstances related to a "global announcement." | critical | 9.8 | 1% |
| CVE-2014-5012 | dompdf/dompdf | DOMPDF denial of service vulnerability | medium | 6.5 | 1% |
| CVE-2021-22958 | concrete5/concrete5 | Server-Side Request Forgery vulnerability in concrete5 | high | 8.2 | 1% |
| CVE-2022-2798 | affiliates-manager (WordPress plugin) | The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering | high | 8.0 | 1% |
| CVE-2021-24998 | simple-jwt-login (WordPress plugin) | The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The | high | 7.5 | 1% |
| CVE-2022-1036 | microweber/microweber | Integer Overflow or Wraparound in Microweber | high | 7.5 | 1% |
| CVE-2022-23799 | joomla/input | Variable Tampering within joomla/input class | critical | 9.8 | 1% |
| CVE-2016-10941 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF. | medium | 6.1 | 1% |
| CVE-2018-1000165 | lightsaml/lightsaml | LightSAML Incorrect Access Control vulnerability | high | 7.5 | 1% |
| CVE-2020-15178 | prestashop/contactform | Potential XSS injection In PrestaShop contactform | high | 8.0 | 1% |
| CVE-2013-4682 | bvbmedia/multishop | Multishop extension for TYPO3 has SQL Injection vulnerability | high | 0.0 | 1% |
| CVE-2013-4748 | georgringer/news | News system (news) extension for TYPO3 vulnerable to SQL Injection | high | 0.0 | 1% |
| CVE-2022-3490 | checkout-field-editor-for-woocommerce (WordPress plugin) | The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings | high | 7.2 | 1% |
| CVE-2017-13761 | fastly/magento2 | Fastly Magento2 sensitive information disclosure | medium | 6.5 | 1% |
| CVE-2019-7881 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2024-11349 | adforest (WordPress plugin) | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plug | critical | 9.8 | 1% |
| CVE-2021-24864 | wp-cloudy (WordPress plugin) | The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the | high | 8.8 | 1% |
| CVE-2024-0509 | wp-404-auto-redirect-to-similar-post (WordPress plugin) | The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in | medium | 6.1 | 1% |
| CVE-2021-41114 | typo3/cms, typo3/cms-core | HTTP Host Header Injection | medium | 4.8 | 1% |
| CVE-2024-28118 | getgrav/grav | Server Side Template Injection (SSTI) | high | 8.8 | 1% |
| CVE-2023-6219 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpress_proce | high | 7.2 | 1% |
| CVE-2024-1813 | simple-job-board (WordPress plugin) | The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserializa | critical | 9.8 | 1% |