Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-40199 | ec-cube/ec-cube | EC-CUBE Directory traversal vulnerability | low | 2.7 | 1% |
| CVE-2013-6919 | james-heinrich/phpthumb | phpThumb is vulnerable to Server-Side Request Forgery (SSRF) | medium | 0.0 | 1% |
| CVE-2023-3162 | payment-gateway-stripe-and-woocommerce-integration (WordPress plugin) | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7. | critical | 9.8 | 1% |
| CVE-2025-7341 | ht-contactform (WordPress plugin) | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file | critical | 9.1 | 1% |
| CVE-2022-4268 | plugin-logic (WordPress plugin) | The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL | high | 7.2 | 1% |
| CVE-2022-0580 | librenms/librenms | Improper Access Control in librenms | high | 7.1 | 1% |
| CVE-2013-2700 | wp125 (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows | medium | 6.8 | 1% |
| CVE-2022-2638 | export-all-urls (WordPress plugin) | The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be t | medium | 6.5 | 1% |
| CVE-2014-4932 | wordfence-security (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbit | medium | 6.1 | 1% |
| CVE-2023-39999 | WordPress core | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1 | medium | 4.3 | 1% |
| CVE-2018-7711 | simplesamlphp/saml2 | SimpleSAMLphp saml2 incorrect signature validation | high | 8.1 | 1% |
| CVE-2019-11016 | elgg/elgg | Elgg open redirect | medium | 6.1 | 1% |
| CVE-2021-24305 | watcheezy (WordPress plugin) | The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability | medium | 6.1 | 1% |
| CVE-2022-32060 | snipe/snipe-it | Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings | medium | 4.8 | 1% |
| CVE-2011-4582 | moodle/moodle | Moodle Open Redirect in Calendar Set Page | medium | 0.0 | 1% |
| CVE-2026-28697 | craftcms/cms | Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates | critical | 0.0 | 1% |
| CVE-2024-9942 | wordpress-gym-management-system (WordPress plugin) | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.8 | 1% |
| CVE-2010-3662 | typo3/cms-backend | TYPO3 SQL injection vulnerability on the backend | high | 8.8 | 1% |
| CVE-2019-18986 | pimcore/pimcore | Pimcore Discloses Usernames In Use | high | 7.5 | 1% |
| CVE-2018-13137 | events-manager (WordPress plugin) | The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type= | medium | 4.8 | 1% |
| CVE-2011-4299 | moodle/moodle | Moodle vulnerable to Cross-Site Scripting | low | 0.0 | 1% |
| CVE-2013-4941 | moodle/moodle | YUI Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 1% |
| CVE-2013-4942 | moodle/moodle | YUI Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 1% |
| CVE-2013-7077 | typo3/cms-core | TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module | medium | 0.0 | 1% |
| CVE-2013-7082 | neos/flow, typo3/flow | TYPO3 Flow Cross-site scripting (XSS) vulnerability | medium | 0.0 | 1% |
| CVE-2014-3547 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | medium | 0.0 | 1% |
| CVE-2019-7860 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Weak PRNG | high | 7.5 | 1% |
| CVE-2019-7886 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cryptographic Flaw | high | 7.5 | 1% |
| CVE-2019-7951 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Information Leak | high | 7.5 | 1% |
| CVE-2024-34077 | mantisbt/mantisbt | Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process | high | 7.3 | 1% |
| CVE-2023-4971 | weaver-xtreme-theme-support (WordPress plugin) | The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object i | high | 7.2 | 1% |
| CVE-2021-24294 | dsgvo-all-in-one-for-wp (WordPress plugin) | The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter | medium | 6.1 | 1% |
| CVE-2021-24792 | shiny-buttons (WordPress plugin) | The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_templa | medium | 6.1 | 1% |
| CVE-2021-24796 | my-tickets (WordPress plugin) | The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it i | medium | 6.1 | 1% |
| CVE-2021-24797 | tickera (WordPress plugin) | The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in | medium | 6.1 | 1% |
| CVE-2021-24967 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allo | medium | 6.1 | 1% |
| CVE-2022-2362 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, whi | high | 7.5 | 1% |
| CVE-2022-1985 | download-manager (WordPress plugin) | The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is d | medium | 6.1 | 1% |
| CVE-2024-4352 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing cap | high | 8.8 | 1% |
| CVE-2021-24377 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Impo | high | 8.1 | 1% |
| CVE-2018-6944 | ultimate-member (WordPress plugin) | core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails | medium | 6.1 | 1% |
| CVE-2015-9410 | powerpress (WordPress plugin) | The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter. | medium | 5.4 | 1% |
| CVE-2023-28330 | moodle/moodle | Moodle arbitrary file read vulnerability | medium | 6.5 | 1% |
| CVE-2016-9955 | simplesamlphp/simplesamlphp | Incorrect signature verification in SimpleSAMLphp | medium | 6.3 | 1% |
| CVE-2012-10018 | mapplic (WordPress plugin) | The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 r | high | 8.3 | 1% |
| CVE-2024-47605 | silverstripe/framework | Silverstripe Framework has a XSS via insert media remote file oembed | medium | 5.4 | 1% |
| CVE-2018-0575 | baserproject/basercms | Sensitive Data Exposure in baserCMS | medium | 5.3 | 1% |
| CVE-2022-2273 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowi | high | 8.8 | 1% |
| CVE-2014-4525 | ebay-feeds-for-wordpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for Wo | medium | 6.1 | 1% |
| CVE-2014-6604 | subscribe2 (WordPress plugin) | Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attack | medium | 6.1 | 1% |