Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-3813 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it pos | high | 7.5 | 1% |
| CVE-2024-1069 | contact-form-entries (WordPress plugin) | The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' | high | 7.2 | 1% |
| CVE-2019-10667 | librenms/librenms | Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS | medium | 5.3 | 1% |
| CVE-2023-47637 | pimcore/pimcore | Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt() | high | 8.8 | 1% |
| CVE-2024-13478 | ltl-freight-quotes-ups-edition (WordPress plugin) | The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' paramet | high | 7.5 | 1% |
| CVE-2017-6929 | drupal/core, drupal/drupal | Drupal cross site scripting vulnerability | medium | 6.1 | 1% |
| CVE-2020-11063 | typo3/cms, typo3/cms-core | Information Disclosure in Password Reset | low | 3.7 | 1% |
| CVE-2023-3169 | tagdiv-composer (WordPress plugin) | The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authoris | medium | 6.1 | 1% |
| CVE-2020-13677 | drupal/core | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which ma | high | 7.5 | 1% |
| CVE-2022-3418 | wp-all-import (WordPress plugin) | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported o | high | 7.2 | 1% |
| CVE-2019-14978 | payu-india-payment-gateway (WordPress plugin) | /payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuanti | medium | 5.3 | 1% |
| CVE-2023-29197 | guzzlehttp/psr7 | Improper header name validation in guzzlehttp/psr7 | medium | 5.3 | 1% |
| CVE-2012-1157 | moodle/moodle | Moodle default permissions too permissive | medium | 4.3 | 1% |
| CVE-2019-10270 | ultimate-member (WordPress plugin) | An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verificati | high | 8.8 | 1% |
| CVE-2019-10911 | symfony/security, symfony/security-http, symfony/symfony | Improper authentication in Symfony | high | 7.5 | 1% |
| CVE-2021-25121 | rating (WordPress plugin) | The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a | medium | 6.5 | 1% |
| CVE-2021-36873 | iq-block-country (WordPress plugin) | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable para | medium | 5.5 | 1% |
| CVE-2024-1974 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, | high | 8.8 | 1% |
| CVE-2022-3131 | search-logger (WordPress plugin) | The Search Logger WordPress plugin through 0.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading | high | 7.2 | 1% |
| CVE-2022-3150 | wp-custom-cursors (WordPress plugin) | The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, lead | high | 7.2 | 1% |
| CVE-2014-8492 | profile-builder (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPres | medium | 6.1 | 1% |
| CVE-2023-0942 | woocommerce-for-japan (WordPress plugin) | The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to | medium | 6.1 | 1% |
| CVE-2022-0203 | bytefury/crater | Missing Authorization in Crater Invoice | medium | 5.3 | 1% |
| CVE-2022-2133 | oauth-single-sign-on (WordPress plugin) | The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attac | medium | 5.3 | 1% |
| CVE-2018-17884 | gwolle-gb (WordPress plugin) | XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-ad | medium | 6.1 | 1% |
| CVE-2018-17947 | snazzy-maps (WordPress plugin) | The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter. | medium | 6.1 | 1% |
| CVE-2015-9537 | nextgen-gallery (WordPress plugin) | The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thum | medium | 5.4 | 1% |
| CVE-2024-2006 | post-grid-carousel-ultimate (WordPress plugin) | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Obj | high | 8.8 | 1% |
| CVE-2024-0699 | ai-engine (WordPress plugin) | The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing | medium | 6.6 | 1% |
| CVE-2019-14950 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. | medium | 6.1 | 1% |
| CVE-2020-8498 | gistpress (WordPress plugin) | XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id paramet | medium | 5.4 | 1% |
| CVE-2021-26642 | xpressengine/xpressengine | XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type | critical | 9.8 | 1% |
| CVE-2021-28931 | forkcms/forkcms | Arbitrary file upload in Fork CMS | high | 8.8 | 1% |
| CVE-2022-36285 | uploading-svgwebp-and-ico-files (WordPress plugin) | Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress. | high | 7.2 | 1% |
| CVE-2022-2400 | dompdf/dompdf | Dompdf before v2.0.0 vulnerable to chroot check bypass | medium | 5.3 | 1% |
| CVE-2022-23982 | perfect-woocommerce-brands (WordPress plugin) | The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure. | medium | 4.3 | 1% |
| CVE-2024-10820 | woocommerce-upload-files (WordPress plugin) | The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_ | critical | 9.8 | 1% |
| CVE-2017-6926 | drupal/core, drupal/drupal | Drupal Comment reply form allows access to restricted content | high | 8.1 | 1% |
| CVE-2013-6389 | drupal/drupal | Drupal has open redirect vulnerability in the Overlay module | high | 7.5 | 1% |
| CVE-2018-5695 | wpjobboard (WordPress plugin) | The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a | high | 7.2 | 1% |
| CVE-2006-4067 | cakephp/cakephp | Cross-site scripting (XSS) vulnerability in CakePHP | medium | 6.5 | 1% |
| CVE-2023-43648 | baserproject/basercms | baserCMS Directory Traversal vulnerability in Form submission data management Feature | medium | 4.9 | 1% |
| CVE-2021-24991 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting | medium | 4.8 | 1% |
| CVE-2013-7079 | friendsoftypo3/openid | TYPO3 OpenID extension Open redirect vulnerability | medium | 0.0 | 1% |
| CVE-2013-7080 | typo3/cms-core | TYPO3 is vulnerable to Mass Assignment in the Extension table administration library | medium | 0.0 | 1% |
| CVE-2023-3172 | froxlor/froxlor | Froxlor vulnerable to Path Traversal | high | 7.2 | 1% |
| CVE-2022-36032 | react/http | ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent | medium | 5.3 | 1% |
| CVE-2021-24140 | ajax-load-more (WordPress plugin) | Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with | high | 7.2 | 1% |
| CVE-2009-4160 | jweiland/kk-downloader | TYPO3 Simple Download-System with Counter and Categories Vulnerable to Information Disclosure | medium | 0.0 | 1% |
| CVE-2022-2546 | all-in-one-wp-migration (WordPress plugin) | The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1 | medium | 4.7 | 1% |