Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-19133 | flarum/framework | Flarum Core Leaks PII | medium | 5.3 | 1% |
| CVE-2023-28333 | moodle/moodle | Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input | critical | 9.8 | 1% |
| CVE-2021-41144 | openmage/magento-lts | Fix for authenticated remote code execution through layout update | high | 8.8 | 1% |
| CVE-2022-1397 | alextselegidis/easyappointments | Privilege escalation in easyappointments | high | 8.8 | 1% |
| CVE-2019-12345 | hostel (WordPress plugin) | XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress. | medium | 6.1 | 1% |
| CVE-2019-15539 | mantisbt/mantisbt | MantisBT XSS when uploading an attachment | medium | 6.1 | 1% |
| CVE-2022-0879 | caldera-forms (WordPress plugin) | The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, | medium | 6.1 | 1% |
| CVE-2007-1893 | WordPress core | xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended | medium | 4.9 | 1% |
| CVE-2024-21911 | tinymce/tinymce | Cross-site scripting vulnerability in TinyMCE | medium | 0.0 | 1% |
| CVE-2024-8349 | uncanny-groups-for-learndash (WordPress plugin) | The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. T | high | 7.2 | 1% |
| CVE-2014-7957 | pods (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the | medium | 6.8 | 1% |
| CVE-2021-24360 | yes\/no-chart (WordPress plugin) | The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing me | medium | 6.5 | 1% |
| CVE-2022-2368 | microweber/microweber | Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password | medium | 6.5 | 1% |
| CVE-2022-0919 | salon-booking-system (WordPress plugin) | The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any | medium | 5.3 | 1% |
| CVE-2008-3228 | joomla/joomla-platform | Joomla! doesn't configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs | medium | 0.0 | 1% |
| CVE-2014-6295 | jbartels/wec-map, web-tp3/wec_map | WEC Map (wec_map) extension for TYPO3 allows SQL Injection | high | 0.0 | 1% |
| CVE-2023-5583 | wp-simple-galleries (WordPress plugin) | The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserializatio | high | 8.8 | 1% |
| CVE-2014-4519 | conversador (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 1% |
| CVE-2014-4523 | easy-career-openings (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject | medium | 6.1 | 1% |
| CVE-2014-4548 | ruven-toolkit (WordPress plugin) | Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attack | medium | 6.1 | 1% |
| CVE-2014-4553 | spreadshirt-rss-3d-cube-flash-gallery (WordPress plugin) | Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitra | medium | 6.1 | 1% |
| CVE-2014-4559 | swipehq-payment-gateway-wp-e-commerce (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for | medium | 6.1 | 1% |
| CVE-2022-1906 | copyright-proof (WordPress plugin) | The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action avai | medium | 6.1 | 1% |
| CVE-2023-25727 | phpmyadmin/phpmyadmin | Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin | medium | 5.4 | 1% |
| CVE-2019-7929 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Information Disclosure | medium | 4.9 | 1% |
| CVE-2011-1940 | phpmyadmin/phpmyadmin | phpMyAdmin Vulnerable to Cross-Site Scripting | low | 0.0 | 1% |
| CVE-2024-11868 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |
| CVE-2020-15881 | munkireport/munki_facts | MunkiReport munki_facts module Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2020-15883 | munkireport/managedinstalls | MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2023-2123 | wp-inventory-manager (WordPress plugin) | The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, le | medium | 6.1 | 1% |
| CVE-2023-30451 | typo3/cms-core | Path Traversal in TYPO3 File Abstraction Layer Storages | medium | 5.5 | 1% |
| CVE-2019-19983 | minify (WordPress plugin) | In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. I | medium | 4.3 | 1% |
| CVE-2020-36842 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on t | high | 8.8 | 1% |
| CVE-2022-22110 | bottelet/flarepoint | Weak Password Requirements in Daybyday CRM | high | 7.5 | 1% |
| CVE-2021-34647 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/i | medium | 6.5 | 1% |
| CVE-2017-18609 | magic-fields (WordPress plugin) | The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter. | medium | 6.1 | 1% |
| CVE-2017-18610 | magic-fields (WordPress plugin) | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter. | medium | 6.1 | 1% |
| CVE-2017-18611 | magic-fields (WordPress plugin) | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter. | medium | 6.1 | 1% |
| CVE-2018-1000162 | erusev/parsedown | Cross-site Scripting in Parsedown | medium | 6.1 | 1% |
| CVE-2021-25022 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id paramet | medium | 6.1 | 1% |
| CVE-2018-19311 | centreon/centreon | Centreon XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2017-15110 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2022-35235 | wpide (WordPress plugin) | Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. | medium | 4.9 | 1% |
| CVE-2020-26136 | silverstripe/graphql | Authentication bypass in SilverStripe GraphQL | medium | 6.5 | 1% |
| CVE-2017-14240 | dolibarr/dolibarr | Dolibarr ERP and CRM Sensitive Data Disclosure | high | 7.5 | 1% |
| CVE-2015-9412 | royal-slider (WordPress plugin) | The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter. | medium | 6.1 | 1% |
| CVE-2023-2624 | kivicare (WordPress plugin) | The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 6.1 | 1% |
| CVE-2022-25355 | ec-cube/ec-cube | EC-CUBE improperly handles HTTP Host header values | medium | 5.3 | 1% |
| CVE-2021-25004 | seur-oficial (WordPress plugin) | The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purp | medium | 4.9 | 1% |
| CVE-2013-4714 | tikiwiki/tiki-manager | Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability | medium | 4.7 | 1% |