Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-7916 | learnpress (WordPress plugin) | be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself | medium | 6.5 | 1% |
| CVE-2016-10970 | supportflow (WordPress plugin) | The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt. | medium | 6.1 | 1% |
| CVE-2026-25498 | craftcms/cms | Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | high | 0.0 | 1% |
| CVE-2022-0263 | pimcore/pimcore | Unrestricted Upload of File with Dangerous Type in pimcore | high | 7.8 | 1% |
| CVE-2018-14774 | symfony/symfony | Symfony Host Header Injection | high | 7.2 | 1% |
| CVE-2021-24153 | wordpress-seo (WordPress plugin) | A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filt | medium | 5.4 | 1% |
| CVE-2022-2089 | bold-page-builder (WordPress plugin) | The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2013-2699 | underconstruction (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2021-24238 | findeo (WordPress plugin), realteo (WordPress plugin) | The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the | medium | 6.5 | 1% |
| CVE-2019-17223 | dolibarr/dolibarr | Dolibarr ERP and CRM HTML Injection | medium | 6.1 | 1% |
| CVE-2018-19995 | dolibarr/dolibarr | Dolibarr stored cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2022-2981 | download-monitor (WordPress plugin) | The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensiti | medium | 4.9 | 1% |
| CVE-2026-33157 | craftcms/cms | Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior | high | 0.0 | 1% |
| CVE-2019-14881 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2021-32716 | shopware/platform, shopware/core | Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.4 | 1% |
| CVE-2022-40315 | moodle/moodle | Moodle Minor SQL injection risk in admin user browsing | critical | 9.8 | 1% |
| CVE-2021-24353 | simple-301-redirects (WordPress plugin) | The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making i | high | 8.8 | 1% |
| CVE-2020-15132 | sulu/sulu | Reset Password / Login vulnerability in Sulu | medium | 5.3 | 1% |
| CVE-2022-3558 | import-users-from-csv-with-meta (WordPress plugin) | The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. | high | 8.0 | 1% |
| CVE-2016-10890 | aryo-activity-log (WordPress plugin) | The aryo-activity-log plugin before 2.3.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-27863 | vikbooking (WordPress plugin) | Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the | medium | 5.3 | 1% |
| CVE-2019-12826 | widget-logic (WordPress plugin) | A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows | high | 8.8 | 1% |
| CVE-2021-24359 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was | medium | 5.3 | 1% |
| CVE-2021-20283 | moodle/moodle | Missing permission check in Moodle | medium | 4.3 | 1% |
| CVE-2014-2572 | moodle/moodle | Moodle attackers to modify grade metadata | medium | 0.0 | 1% |
| CVE-2021-22951 | concrete5/core | Password exposure in concrete5/core | medium | 0.0 | 1% |
| CVE-2025-50706 | topthink/framework | ThinkPHP Path Traversal Vulnerability | critical | 0.0 | 1% |
| CVE-2021-30108 | feehi/cms | Server-Side Request Forgery in Feehi CMS | critical | 9.1 | 1% |
| CVE-2017-1000067 | modx/revolution | MODX Revolution blind SQL injection | high | 8.8 | 1% |
| CVE-2012-6707 | WordPress core | WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values | high | 7.5 | 1% |
| CVE-2022-37783 | craftcms/cms | Craft CMS discloses password hashes | high | 7.5 | 1% |
| CVE-2021-24985 | easy-forms-for-mailchimp (WordPress plugin) | The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outp | medium | 6.1 | 1% |
| CVE-2021-41750 | nystudio107/craft-seomatic | Cross-site Scripting in SEOmatic plugin | medium | 6.1 | 1% |
| CVE-2017-12849 | silverstripe/cms | Silverstripe CMS User Enumeration | medium | 5.3 | 1% |
| CVE-2022-30598 | moodle/moodle | Exposure of Sensitive Information in moodle | medium | 4.3 | 1% |
| CVE-2022-23984 | wpdiscuz (WordPress plugin) | Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). | low | 3.7 | 1% |
| CVE-2019-19745 | contao/contao, contao/core-bundle | Unrestricted file uploads in Contao | high | 8.8 | 1% |
| CVE-2024-25298 | redaxo/source | Code injection in REDAXO | high | 7.2 | 1% |
| CVE-2022-24749 | sylius/sylius | Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius | medium | 6.1 | 1% |
| CVE-2018-20713 | shopware/shopware | Shopware SQL Injection | high | 8.8 | 1% |
| CVE-2017-1000046 | mautic/core | Sensitive Cookie Without HttpOnly and Secure Flag | high | 7.5 | 1% |
| CVE-2010-5100 | typo3/cms-install | TYPO3 Cross-Site Scripting vulnerability in the Install Tool | low | 0.0 | 1% |
| CVE-2019-14880 | moodle/moodle | Moodle Oauth 2 Insufficiently Protects Against Compromise | critical | 9.1 | 1% |
| CVE-2020-13670 | drupal/core, drupal/drupal | A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent pr | high | 7.5 | 1% |
| CVE-2019-14273 | silverstripe/framework | Broken access control on files | medium | 5.3 | 1% |
| CVE-2019-16669 | pagekit/pagekit | Pagekit User enumeration | medium | 5.3 | 1% |
| CVE-2018-10225 | topthink/framework | thinkphp SQL Injection via the index.php s parameter | critical | 9.8 | 1% |
| CVE-2023-28667 | lead-generated (WordPress plugin) | The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels para | critical | 9.8 | 1% |
| CVE-2022-0690 | microweber/microweber | Cross-site Scripting in microweber | high | 8.8 | 1% |
| CVE-2022-34868 | yookassa (WordPress plugin) | Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. | high | 8.8 | 1% |