Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4351 | qe-seo-handyman (WordPress plugin) | The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leadi | high | 7.2 | 1% |
| CVE-2022-4360 | wp-rss-by-publishers (WordPress plugin) | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, | high | 7.2 | 1% |
| CVE-2021-32478 | moodle/moodle | Moodle reflected XSS | medium | 6.1 | 1% |
| CVE-2017-20194 | formidable-form-builder (WordPress plugin) | The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the | medium | 5.3 | 1% |
| CVE-2022-31047 | typo3/cms, typo3/cms-core | Insertion of Sensitive Information into Log File in typo3/cms-core | medium | 5.3 | 1% |
| CVE-2012-3387 | moodle/moodle | Moodle Authentication Bypass in File Upload | medium | 0.0 | 1% |
| CVE-2022-42188 | lavalite/cms | Lavalite vulnerable to Arbitrary File Read via Directory Traversal | high | 7.5 | 1% |
| CVE-2022-2392 | lana-downloads-manager (WordPress plugin) | The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by us | medium | 6.5 | 1% |
| CVE-2021-46433 | fenom/fenom | Sandbox bypass in fenom | critical | 10.0 | 1% |
| CVE-2023-32692 | codeigniter4/framework | Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4 | critical | 9.8 | 1% |
| CVE-2023-3343 | user-registration (WordPress plugin) | The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization | high | 8.8 | 1% |
| CVE-2023-40180 | silverstripe/graphql | Silverstripe GraphQL has DDOS Vulnerability due to lack of protection against recursive queries | high | 7.5 | 1% |
| CVE-2021-43560 | moodle/moodle | Moodle Insecure direct object reference (IDOR) in a calendar web service | medium | 5.3 | 1% |
| CVE-2021-4341 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, | critical | 9.8 | 1% |
| CVE-2023-36825 | orchid/platform | Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution | critical | 9.8 | 1% |
| CVE-2023-0080 | customer-reviews-for-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow user | high | 8.8 | 1% |
| CVE-2012-1209 | forkcms/forkcms | Fork CMS XSS via Highlight Parameter | medium | 0.0 | 1% |
| CVE-2020-29604 | mantisbt/mantisbt | MantisBT Missing Authorization access check in bug_actiongroup.php | medium | 6.5 | 1% |
| CVE-2021-32697 | neos/form | Form validation can be skipped | medium | 6.5 | 1% |
| CVE-2021-24833 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview mod | medium | 5.4 | 1% |
| CVE-2022-3989 | motors---car-dealer\,-classifieds-\&-listing (WordPress plugin) | The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action | high | 8.8 | 1% |
| CVE-2014-2297 | videowhisper-live-streaming-integration (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote | medium | 6.1 | 1% |
| CVE-2017-9419 | wp-custom-fields-search (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inj | medium | 6.1 | 1% |
| CVE-2023-5244 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2024-5333 | the-events-calendar (WordPress plugin) | The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access i | medium | 5.3 | 1% |
| CVE-2022-39284 | codeigniter4/framework | Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued | low | 2.6 | 1% |
| CVE-2023-47129 | statamic/cms | Statamic CMS remote code execution via front-end form uploads | high | 8.3 | 1% |
| CVE-2017-1000016 | phpmyadmin/phpmyadmin | phpMyAdmin Cookie attribute injection attack | high | 7.5 | 1% |
| CVE-2022-0277 | microweber/microweber | Microweber Incorrect Permission Assignment for Critical Resource vulnerability | medium | 6.5 | 1% |
| CVE-2018-11408 | symfony/security-bundle, symfony/symfony | Symfony Open Redirect | medium | 6.1 | 1% |
| CVE-2017-6954 | buddypress/buddypress | BuddyPress Docs plugin Improper Privilege Management | medium | 4.3 | 1% |
| CVE-2025-1282 | car-dealer-automotive (WordPress theme) | The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file | high | 8.8 | 1% |
| CVE-2023-2435 | blog-in-blog (WordPress plugin) | The Blog-in-Blog plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.0 via a shortcode attribut | high | 7.2 | 1% |
| CVE-2022-1961 | duracelltomi-google-tag-manager (WordPress plugin) | The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4 | medium | 5.5 | 1% |
| CVE-2023-1478 | hummingbird (WordPress plugin) | The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to | critical | 9.8 | 1% |
| CVE-2023-3173 | froxlor/froxlor | Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts | critical | 9.8 | 1% |
| CVE-2023-0671 | froxlor/froxlor | froxlor is vulnerable to privilege escalation from customer to root via directory-options | high | 8.8 | 1% |
| CVE-2017-14920 | egroupware/egroupware | eGroupware Community Edition Stored XSS vulnerability | medium | 6.1 | 1% |
| CVE-2018-0573 | baserproject/basercms | baserCMS Access Control Bypass | medium | 5.3 | 1% |
| CVE-2013-1832 | moodle/moodle | Moodle includes the WebDAV password in the configuration form | medium | 0.0 | 1% |
| CVE-2025-46002 | simogeo/filemanager | Filemanager is vulnerable to Relative Path Traversal through filemanager.php | medium | 6.5 | 1% |
| CVE-2022-1167 | careerup (WordPress plugin) | There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the fi | medium | 6.1 | 1% |
| CVE-2012-6099 | moodle/moodle | Moodle Arbitrary File Read via Backup Functionality | medium | 0.0 | 1% |
| CVE-2013-4321 | typo3/cms | TYPO3 vulnerable to remote authenticated arbitrary code execution | high | 0.0 | 1% |
| CVE-2014-3946 | typo3/cms | Typo3 Information Disclosure | medium | 0.0 | 1% |
| CVE-2024-5441 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featu | high | 8.8 | 1% |
| CVE-2015-3998 | adsense-click-fraud-monitoring (WordPress plugin) | Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows | medium | 6.1 | 1% |
| CVE-2026-65608 | getgrav/grav | Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation | high | 8.8 | 1% |
| CVE-2017-1000489 | mautic/core | Disabled users able to log in with third party SSO plugin | high | 8.1 | 1% |
| CVE-2022-1540 | postmagthemes-demo-import (WordPress plugin) | The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admi | high | 7.2 | 1% |