Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-33297 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 0.0 | 1% |
| CVE-2024-33299 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 0.0 | 1% |
| CVE-2024-0683 | bulgarisation-for-woocommerce (WordPress plugin) | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several func | high | 7.3 | 1% |
| CVE-2023-3820 | pimcore/pimcore | Pimcore vulnerable to SQL Injection in Dataobjects sorting | high | 7.2 | 1% |
| CVE-2014-7151 | nex-forms-lite (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitr | medium | 6.1 | 1% |
| CVE-2019-17213 | webarx (WordPress plugin) | The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. | medium | 6.1 | 1% |
| CVE-2010-1153 | typo3/cms | TYPO3 PHP remote file inclusion vulnerability | high | 0.0 | 1% |
| CVE-2024-1950 | woo-product-carousel-slider-and-grid-ultimate (WordPress plugin) | The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to | high | 7.5 | 1% |
| CVE-2014-6444 | titan-framework (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject | medium | 6.1 | 1% |
| CVE-2015-2329 | woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary we | medium | 6.1 | 1% |
| CVE-2020-11731 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assista | medium | 6.1 | 1% |
| CVE-2021-4360 | controlled-admin-access (WordPress plugin) | The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not proper | critical | 9.9 | 1% |
| CVE-2017-8383 | craftcms/cms | Craft CMS Unauthorized View | medium | 5.3 | 1% |
| CVE-2020-14205 | divebook (WordPress plugin) | The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization c | medium | 5.3 | 1% |
| CVE-2022-1064 | forkcms/forkcms | SQL Injection in Fork CMS | high | 8.8 | 1% |
| CVE-2022-3608 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ vulnerable to Cross-site Scripting | high | 8.4 | 1% |
| CVE-2024-10011 | buddypress (WordPress plugin) | The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. | high | 8.1 | 1% |
| CVE-2020-11497 | nab-transact (WordPress plugin) | An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows | high | 7.5 | 1% |
| CVE-2017-1000015 | phpmyadmin/phpmyadmin | phpMyAdmin CSS Injection Vulnerability | medium | 6.1 | 1% |
| CVE-2020-7996 | dolibarr/dolibarr | XSS in Dolibarr ERP & CRM | medium | 6.1 | 1% |
| CVE-2020-10960 | mediawiki/core | MediaWiki makeCollapsible allows applying event handler to any CSS selector | medium | 5.3 | 1% |
| CVE-2009-1264 | sjbr/sr-feuser-register | Frontend User Registration extension for TYPO3 does not properly verify access rights | high | 0.0 | 1% |
| CVE-2024-1468 | avada (WordPress theme) | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type | high | 8.8 | 1% |
| CVE-2024-27299 | phpmyfaq/phpmyfaq | phpMyFAQ SQL Injection at "Save News" | high | 8.8 | 1% |
| CVE-2019-7849 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Session Fixation Check | high | 7.5 | 1% |
| CVE-2023-4724 | export-any-wordpress-data-to-xml\/csv (WordPress plugin), wp-all-export (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate an | high | 7.2 | 1% |
| CVE-2014-9334 | bird-feeder (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack th | medium | 6.8 | 1% |
| CVE-2014-9460 | wp-vipergb (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hi | medium | 6.8 | 1% |
| CVE-2015-0920 | banner-effect-header (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the | medium | 6.8 | 1% |
| CVE-2022-0504 | microweber/microweber | Generation of Error Message Containing Sensitive Information in microweber | medium | 6.5 | 1% |
| CVE-2020-24313 | ultimate-appointment-scheduling (WordPress plugin) | Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointmen | medium | 6.1 | 1% |
| CVE-2022-2117 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wa | medium | 5.3 | 1% |
| CVE-2013-4250 | typo3/cms | TYPO3 doesn't properly check file extensions | high | 0.0 | 1% |
| CVE-2010-3667 | typo3/cms-frontend | TYPO3 is vulnerable to Spam Abuse in the native form content element | medium | 5.3 | 1% |
| CVE-2021-24289 | store-locator-plus (WordPress plugin) | There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update | high | 8.8 | 1% |
| CVE-2022-3769 | owm-weather (WordPress plugin) | The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading | high | 8.8 | 1% |
| CVE-2022-3848 | wp-user-merger (WordPress plugin) | The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leadi | high | 8.8 | 1% |
| CVE-2022-3849 | wp-user-merger (WordPress plugin) | The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leadi | high | 8.8 | 1% |
| CVE-2022-3865 | wp-user-merger (WordPress plugin) | The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leadi | high | 8.8 | 1% |
| CVE-2020-5275 | symfony/security, symfony/security-http, symfony/symfony | Firewall configured with unanimous strategy was not actually unanimous in Symfony | high | 7.6 | 1% |
| CVE-2021-25023 | speed-booster-pack (WordPress plugin) | The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter b | high | 7.2 | 1% |
| CVE-2021-24124 | wp-shieldon (WordPress plugin) | Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflect | medium | 6.1 | 1% |
| CVE-2020-11083 | october/backend | Stored XSS in October | low | 3.5 | 1% |
| CVE-2020-14443 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in accountancy/customer/card.php | high | 8.8 | 1% |
| CVE-2015-10087 | designfolio-plus (WordPress plugin) | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in UpThemes Theme DesignFolio Plus 1.2 on WordPress and classified as problem | medium | 6.3 | 1% |
| CVE-2024-13488 | ltl-freight-quotes-estes-edition (WordPress plugin) | The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' paramete | high | 7.5 | 1% |
| CVE-2024-8066 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' | high | 7.5 | 1% |
| CVE-2012-4448 | WordPress core | Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authenticatio | medium | 6.8 | 1% |
| CVE-2021-22967 | concrete5/core | Exposure of sensitive information in concrete5/core | medium | 0.0 | 1% |
| CVE-2020-25750 | devgroup/dotplant | DotPlant2 Improper Restriction of XML External Entity Reference | high | 7.5 | 1% |