Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-21426 | openmage/magento-lts | Fixes a bug in Zend Framework's Stream HTTP Wrapper | critical | 9.8 | 1% |
| CVE-2023-2719 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before | high | 8.8 | 1% |
| CVE-2020-24940 | illuminate/database | Guard bypass in Eloquent models affecting Laravel illuminate database component | high | 7.5 | 1% |
| CVE-2010-3666 | typo3/cms-install | TYPO3 is vulnerable to Insecure randomness in uniqid function | medium | 5.3 | 1% |
| CVE-2010-3673 | typo3/cms-core | TYPO3 is vulnerable to Information Disclosure in the HTML mailing API | medium | 5.3 | 1% |
| CVE-2019-16409 | silverstripe/framework, symbiote/silverstripe-versionedfiles | SilverStripe Versioned Files module Unpublished files are exposed publicly | medium | 5.3 | 1% |
| CVE-2022-24728 | drupal/core | The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has | unknown | 0.0 | 1% |
| CVE-2018-18529 | topthink/framework | ThinkPHP SQLi Vulnerability | critical | 9.8 | 1% |
| CVE-2018-18530 | topthink/framework | ThinkPHP SQLi Vulnerability | critical | 9.8 | 1% |
| CVE-2018-5372 | testimonial-slider (WordPress plugin) | The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter). | high | 8.8 | 1% |
| CVE-2018-5373 | smooth-slider (WordPress plugin) | The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter). | high | 8.8 | 1% |
| CVE-2018-5374 | dbox-slider (WordPress plugin) | The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter). | high | 8.8 | 1% |
| CVE-2022-2367 | wsm-downloader (WordPress plugin) | The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed | high | 7.5 | 1% |
| CVE-2011-2714 | drupal/core | Drupal Cross-Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-24980 | kitodo/presentation | SSRF in Kitodo.Presentation | high | 7.5 | 1% |
| CVE-2022-1091 | darylldoyle/safe-svg, safe-svg (WordPress plugin) | Cross site scripting in safe-svg | medium | 6.1 | 1% |
| CVE-2022-0611 | snipe/snipe-it | Improper Privilege Management in Snipe-IT | high | 8.8 | 1% |
| CVE-2022-1538 | theme-demo-import (WordPress plugin) | Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload a | high | 7.2 | 1% |
| CVE-2010-3664 | typo3/cms-backend | TYPO3 is vulnerable to Information Disclosure on the backend | medium | 6.5 | 1% |
| CVE-2018-17074 | wordpress-feed-statistics (WordPress plugin) | The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter. | medium | 6.1 | 1% |
| CVE-2019-12465 | librenms/librenms | SQL Injection in LibreNMS | high | 8.1 | 1% |
| CVE-2021-25009 | correosexpress (WordPress plugin) | The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such | medium | 5.3 | 1% |
| CVE-2024-7950 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusio | critical | 9.8 | 1% |
| CVE-2018-19609 | showdoc/showdoc | Showdoc Forced Browsing | medium | 6.5 | 1% |
| CVE-2020-36175 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. | medium | 5.3 | 1% |
| CVE-2024-8852 | all-in-one-wp-migration (WordPress plugin) | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | medium | 5.3 | 1% |
| CVE-2020-5274 | symfony/error-handler, symfony/symfony | Exceptions displayed in non-debug configurations in Symfony | medium | 4.6 | 1% |
| CVE-2021-4361 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job | high | 8.8 | 1% |
| CVE-2023-0865 | woocommerce-multiple-customer-addresses-\&-shipping (WordPress plugin) | The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/ | high | 8.8 | 1% |
| CVE-2021-25093 | link-library (WordPress plugin) | The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to d | high | 7.5 | 1% |
| CVE-2015-1614 | image-metadata-cruncher (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hij | medium | 6.8 | 1% |
| CVE-2015-2039 | acobot-live-chat-\&-contact-form (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote atta | medium | 6.8 | 1% |
| CVE-2016-8642 | moodle/moodle | Moodle Unauthenticated Access | medium | 5.3 | 1% |
| CVE-2023-28329 | moodle/moodle | Moodle SQL Injection vulnerability | high | 8.8 | 1% |
| CVE-2013-3253 | xhanch-my-twitter (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows rem | medium | 6.8 | 1% |
| CVE-2020-8594 | ninja-forms (WordPress plugin) | The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptc | medium | 5.4 | 1% |
| CVE-2023-29141 | mediawiki/core | X-Forwarded-For header allows brute-forcing autoblocked IP addresses | critical | 9.8 | 1% |
| CVE-2017-18121 | simplesamlphp/simplesamlphp | SimpleSAMLphp XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2019-15317 | give (WordPress plugin) | The give plugin before 2.4.7 for WordPress has XSS via a donor name. | medium | 5.4 | 1% |
| CVE-2019-19198 | scoutnet-kalender (WordPress plugin) | The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS. | medium | 5.4 | 1% |
| CVE-2022-42497 | api2cart-bridge-connector (WordPress plugin) | Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress. | critical | 10.0 | 1% |
| CVE-2022-44136 | tribalsystems/zenario | Zenario CMS is vulnerable to Remote Code Execution (RCE). | critical | 9.8 | 1% |
| CVE-2020-13426 | multi-scheduler (WordPress plugin) | The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the | medium | 6.5 | 1% |
| CVE-2014-4567 | video-comments-webcam-recorder (WordPress plugin) | Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downlo | medium | 6.1 | 1% |
| CVE-2022-4321 | pdf-generator-for-wordpress (WordPress plugin) | The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scr | medium | 6.1 | 1% |
| CVE-2017-14775 | illuminate/auth, laravel/framework | Laravel Sensitive Data Exposure | medium | 5.9 | 1% |
| CVE-2025-3439 | everest-forms (WordPress plugin) | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Ob | critical | 9.8 | 1% |
| CVE-2017-13138 | bridge (WordPress theme) | DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary | medium | 6.1 | 1% |
| CVE-2019-25150 | email-templates (WordPress plugin) | The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for a | high | 8.8 | 1% |
| CVE-2023-23491 | quick-event-manager (WordPress plugin) | The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' p | medium | 6.1 | 1% |