Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-7240 | easy-contact-form-solution (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject | medium | 6.1 | 1% |
| CVE-2014-8758 | gallery-bank (WordPress plugin) | Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 1% |
| CVE-2019-15829 | photoblocks-grid-gallery (WordPress plugin) | The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. | medium | 4.8 | 1% |
| CVE-2020-5297 | october/cms | Upload whitelisted files to any directory in OctoberCMS | low | 3.4 | 1% |
| CVE-2020-36698 | security-\&-malware-scan (WordPress plugin) | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and includin | high | 8.8 | 1% |
| CVE-2016-3166 | drupal/core, drupal/drupal | Drupal CRLF injection vulnerability in the drupal_set_header function | medium | 5.9 | 1% |
| CVE-2019-11767 | phpbb/phpbb | phpBB Server side request forgery (SSRF) | medium | 5.8 | 1% |
| CVE-2021-24869 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL sta | high | 8.8 | 1% |
| CVE-2022-1614 | wp-email (WordPress plugin) | The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes | high | 7.5 | 1% |
| CVE-2015-6523 | portfolio-by-lisa-westlund (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the auth | medium | 6.8 | 1% |
| CVE-2020-16266 | mantisbt/mantisbt | MantisBT XSS issue on the view_all_bug_page.php | medium | 5.4 | 1% |
| CVE-2023-38492 | getkirby/cms | Denial of service from unlimited password lengths | medium | 5.3 | 1% |
| CVE-2021-24585 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sen | medium | 6.5 | 1% |
| CVE-2015-9403 | neuvoo-jobroll (WordPress plugin) | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. | medium | 6.1 | 1% |
| CVE-2015-9419 | captain-slider (WordPress plugin) | The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section. | medium | 6.1 | 1% |
| CVE-2016-11001 | user-submitted-posts (WordPress plugin) | The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. | medium | 6.1 | 1% |
| CVE-2011-4203 | moodle/moodle | Moodle CRLF Injection Vulnerability in Calendar Component | medium | 0.0 | 1% |
| CVE-2012-6145 | typo3/cms | Typo3 Backend History Module Vulnerable to XSS | low | 0.0 | 1% |
| CVE-2012-6148 | typo3/cms | Typo3 Function Menu API XSS Vulnerability | low | 0.0 | 1% |
| CVE-2020-36700 | kingcomposer (WordPress plugin) | The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is d | high | 8.8 | 1% |
| CVE-2022-1567 | wp-js (WordPress plugin) | The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and ech | medium | 6.1 | 1% |
| CVE-2021-4340 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1. | critical | 9.8 | 1% |
| CVE-2021-24352 | simple-301-redirects (WordPress plugin) | The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making i | high | 8.8 | 1% |
| CVE-2019-7915 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition DoS vulnerability | high | 7.5 | 1% |
| CVE-2019-7928 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition DoS vulnerability | high | 7.5 | 1% |
| CVE-2017-6932 | drupal/core, drupal/drupal | Drupal external link injection vulnerability | medium | 4.7 | 1% |
| CVE-2022-24711 | codeigniter4/framework | Remote CLI Command Execution Vulnerability in CodeIgniter4 | critical | 9.4 | 1% |
| CVE-2026-42569 | nabeel/phpvms | phpVMS has an /importer authorization bypass causing full database wipe | critical | 9.4 | 1% |
| CVE-2021-24234 | ivory-search (WordPress plugin) | The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the p | medium | 6.1 | 1% |
| CVE-2015-9392 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter. | medium | 5.4 | 1% |
| CVE-2010-1616 | moodle/moodle | Moodle is vulnerable to unauthorized new accounts creation | medium | 0.0 | 1% |
| CVE-2012-6432 | symfony/symfony | Symfony Access Control Vulnerability | medium | 0.0 | 1% |
| CVE-2023-2781 | woo-confirmation-email (WordPress plugin) | The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in ve | high | 8.1 | 1% |
| CVE-2021-43835 | sulu/sulu | Privilege escalation in the Sulu Admin panel | high | 7.2 | 1% |
| CVE-2020-14042 | codiad/codiad | Codiad Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2020-9584 | magento/community-edition, magento/core, magento/project-community-edition | Magento Stored cross-site scripting | medium | 5.4 | 1% |
| CVE-2016-3733 | moodle/moodle | Moodle Improper Access Control | medium | 4.3 | 1% |
| CVE-2014-9413 | simple-ip-ban (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the IP Ban (simple-ip-ban) plugin 1.2.3 for WordPress allow remote attackers t | medium | 6.8 | 1% |
| CVE-2014-9454 | simple-sticky-footer (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer plugin before 1.3.3 for WordPress allow remote attack | medium | 6.8 | 1% |
| CVE-2014-9524 | cardoza-facebook-like-box (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Facebook Like Box (cardoza-facebook-like-box) plugin before 2.8.3 for Word | medium | 6.8 | 1% |
| CVE-2015-5269 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2022-1186 | be-popia-compliant (WordPress plugin) | The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and userna | medium | 5.3 | 1% |
| CVE-2019-11590 | form-maker (WordPress plugin) | The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local f | high | 8.8 | 1% |
| CVE-2021-24465 | meow-gallery (WordPress plugin) | The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available f | high | 8.1 | 1% |
| CVE-2019-8108 | magento/community-edition, magento/product-community-edition | Magento Broken authentication and session managememt | medium | 6.5 | 1% |
| CVE-2021-42363 | woo-preview-emails (WordPress plugin) | The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in | medium | 6.1 | 1% |
| CVE-2021-24840 | squaretype (WordPress plugin) | The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display | medium | 5.3 | 1% |
| CVE-2020-15535 | car-rental-system (WordPress plugin) | An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the regis | medium | 6.1 | 1% |
| CVE-2020-15536 | online-hotel-booking-system (WordPress plugin) | An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of th | medium | 6.1 | 1% |
| CVE-2020-15537 | vanguard (WordPress plugin) | An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI | medium | 6.1 | 1% |