Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-13094 | dolibarr/dolibarr | XSS in Dolibarr | medium | 5.4 | 1% |
| CVE-2019-13463 | simple-link-directory (WordPress plugin) | An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers | medium | 6.1 | 1% |
| CVE-2019-7854 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition IDOR Vulnerability | high | 7.5 | 1% |
| CVE-2014-3617 | moodle/moodle | Moodle allows discovery of an author's username | medium | 0.0 | 1% |
| CVE-2025-1304 | newsblogger (WordPress theme) | The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and | high | 8.8 | 1% |
| CVE-2023-30944 | moodle/moodle | Moodle SQL Injection vulnerability | high | 7.3 | 1% |
| CVE-2015-4140 | wp-smiley (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentica | medium | 6.8 | 1% |
| CVE-2015-8755 | typo3/cms | Typo3 XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2024-6172 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | critical | 9.8 | 1% |
| CVE-2022-33970 | shortcode-addons (WordPress plugin) | Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress. | high | 7.2 | 1% |
| CVE-2011-4901 | typo3/cms | Typo3 Arbitrary Information Disclosure | medium | 6.5 | 1% |
| CVE-2011-4904 | typo3/cms | Typo3 Improper Access Control | medium | 6.5 | 1% |
| CVE-2016-6628 | phpmyadmin/phpmyadmin | phpMyAdmin Reflected File Download attack | medium | 6.3 | 1% |
| CVE-2024-10936 | string-locator (WordPress plugin) | The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserializatio | high | 8.8 | 1% |
| CVE-2024-0668 | advanced-database-cleaner (WordPress plugin) | The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via des | medium | 6.6 | 1% |
| CVE-2016-10899 | total-security (WordPress plugin) | The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability. | medium | 5.3 | 1% |
| CVE-2008-3227 | joomla/framework | Joomla! Open Redirect vulnerability | high | 0.0 | 1% |
| CVE-2020-36725 | ti-woocommerce-wishlist (WordPress plugin) | The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versi | high | 8.8 | 1% |
| CVE-2023-4598 | wp-slimstat (WordPress plugin) | The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0. | high | 8.8 | 1% |
| CVE-2020-11671 | nilsteampassnet/teampass | Missing Authorization in TeamPass | high | 8.1 | 1% |
| CVE-2024-7129 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig T | high | 7.2 | 1% |
| CVE-2023-3551 | nilsteampassnet/teampass | TeamPass Code Injection vulnerability | critical | 9.1 | 1% |
| CVE-2023-6979 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the | high | 8.8 | 1% |
| CVE-2024-1567 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in t | high | 8.2 | 1% |
| CVE-2018-10189 | mautic/core | Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID | high | 7.5 | 1% |
| CVE-2021-39349 | author-bio-box (WordPress plugin) | The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via s | medium | 5.5 | 1% |
| CVE-2026-42613 | getgrav/grav | Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access | critical | 9.4 | 1% |
| CVE-2021-32712 | shopware/shopware | Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2022-3915 | dokan (WordPress plugin) | The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a S | critical | 9.8 | 1% |
| CVE-2022-1557 | uleak-security-dashboard (WordPress plugin) | The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and i | medium | 5.4 | 1% |
| CVE-2024-34107 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2020-17551 | impresscms/impresscms | Cross-site scripting (XSS) | medium | 4.8 | 1% |
| CVE-2021-39351 | wp-bannerize (WordPress plugin) | The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin. | medium | 6.5 | 1% |
| CVE-2017-10795 | intelliants/subrion | Subrion Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2018-19784 | athlon1600/php-proxy | Weak Cryptography in PHP-Proxy | high | 7.5 | 1% |
| CVE-2023-5538 | mpoperationlogs (WordPress plugin) | The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and incl | high | 7.2 | 1% |
| CVE-2022-2222 | download-monitor (WordPress plugin) | The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensiti | medium | 4.9 | 1% |
| CVE-2022-33142 | bp-better-messages (WordPress plugin) | Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress. | high | 7.7 | 1% |
| CVE-2020-36170 | ultimate-member (WordPress plugin) | The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. | medium | 5.3 | 1% |
| CVE-2020-36173 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. | medium | 5.3 | 1% |
| CVE-2021-24310 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allow | medium | 4.8 | 1% |
| CVE-2022-34839 | oauth2-server (WordPress plugin) | Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress. | medium | 5.9 | 1% |
| CVE-2021-43852 | oro/platform | Client-Side JavaScript Prototype Pollution in oro/platform | medium | 5.3 | 1% |
| CVE-2018-1044 | moodle/moodle | Moodle Privilege escalation in quiz web services | medium | 4.3 | 1% |
| CVE-2016-3734 | moodle/moodle | Moodle Cross-site request forgery (CSRF) vulnerability | high | 8.8 | 1% |
| CVE-2019-13414 | rencontre (WordPress plugin) | The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php. | medium | 6.1 | 1% |
| CVE-2023-2579 | inventorypress (WordPress plugin) | The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of | medium | 5.4 | 1% |
| CVE-2018-0571 | baserproject/basercms | baserCMS arbitrary file upload vulnerability | medium | 4.3 | 1% |
| CVE-2009-3628 | typo3/cms-backend | TYPO3 Backend Discloses Encryption Key | medium | 0.0 | 1% |
| CVE-2022-0153 | forkcms/forkcms | SQL Injection in Fork CMS | high | 7.5 | 1% |