Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-10959 | estatik (WordPress plugin) | The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-ad | medium | 6.5 | 1% |
| CVE-2016-10736 | social-pug (WordPress plugin) | The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_ | medium | 6.1 | 1% |
| CVE-2023-48217 | statamic/cms | Statamic CMS vulnerable to remote code execution via form uploads | high | 8.8 | 1% |
| CVE-2020-25812 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2020-25815 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-21338 | typo3/cms, typo3/cms-core | Open Redirection in Login Handling | medium | 6.1 | 1% |
| CVE-2024-6845 | chatbot-with-chatgpt (WordPress plugin) | The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthentica | medium | 5.3 | 1% |
| CVE-2015-0270 | zendframework/zend-db, zendframework/zendframework | Zend Framework Allows SQL Injection | critical | 9.8 | 1% |
| CVE-2020-35947 | pagelayer (WordPress plugin) | An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks | high | 7.4 | 1% |
| CVE-2025-6220 | ultimate-addons-for-contact-form-7 (WordPress plugin) | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the | high | 7.2 | 1% |
| CVE-2015-9444 | altos-connect (WordPress plugin) | The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ P | medium | 6.1 | 1% |
| CVE-2024-9988 | crypto (WordPress plugin) | The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing valida | critical | 9.8 | 1% |
| CVE-2018-1134 | moodle/moodle | Moodle Improper Privilege Management | medium | 6.5 | 1% |
| CVE-2022-2460 | wpdating (WordPress plugin) | The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to mu | critical | 9.8 | 1% |
| CVE-2023-5041 | track-the-click (WordPress plugin) | The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them | high | 8.8 | 1% |
| CVE-2008-6507 | phpbb/phpbb | phpBB vulnerable to sensitive information disclosure | high | 7.5 | 1% |
| CVE-2017-1000477 | desperado/xml-bundle | XXE Vulnerability in XMLBundle 0.1.7 | high | 7.5 | 1% |
| CVE-2021-36874 | ulisting (WordPress plugin) | Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5). | high | 7.1 | 1% |
| CVE-2018-25047 | smarty/smarty | Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto | medium | 5.4 | 1% |
| CVE-2023-3249 | web3-authentication (WordPress plugin) | The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and includi | critical | 9.8 | 1% |
| CVE-2017-20064 | elefant/cms | Code injection in Elefant CMS | high | 8.8 | 1% |
| CVE-2019-6257 | studio-42/elfinder | elFinder Server Side Request Forgery (SSRF) | high | 7.7 | 1% |
| CVE-2016-5012 | moodle/moodle | Moodle Glossary search displays entries without checking user permissions to view them | medium | 5.3 | 1% |
| CVE-2020-28925 | bolt/bolt | OS Command injection in Bolt | medium | 5.3 | 1% |
| CVE-2022-24747 | shopware/core, shopware/platform, shopware/storefront | HTTP caching is marking private HTTP headers as public in Shopware | medium | 6.3 | 1% |
| CVE-2018-14846 | multi-step-form (WordPress plugin) | The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php. | medium | 5.4 | 1% |
| CVE-2017-12157 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 1% |
| CVE-2023-0255 | enable-media-replace (WordPress plugin) | The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow | high | 8.8 | 1% |
| CVE-2023-5673 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attac | high | 8.8 | 1% |
| CVE-2020-26211 | ssddanbrown/bookstack | Bookstack Cross-site Scripting vulnerability | high | 8.7 | 1% |
| CVE-2015-9408 | xpinner-lite (WordPress plugin) | The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS. | medium | 6.5 | 1% |
| CVE-2015-9409 | alo-easymail (WordPress plugin) | The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php. | medium | 6.5 | 1% |
| CVE-2015-9413 | eshop (WordPress plugin) | The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title paramete | medium | 6.5 | 1% |
| CVE-2015-9427 | googmonify (WordPress plugin) | The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID o | medium | 6.5 | 1% |
| CVE-2022-1820 | keep-backup-daily (WordPress plugin) | The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and incl | medium | 6.1 | 1% |
| CVE-2022-1822 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up t | medium | 6.1 | 1% |
| CVE-2023-5863 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2023-4488 | dropbox-folder-share (WordPress plugin) | The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php | critical | 9.8 | 1% |
| CVE-2023-6140 | essential-real-estate (WordPress plugin) | The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from m | high | 8.8 | 1% |
| CVE-2022-43686 | concrete5/concrete5 | Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS | medium | 6.5 | 1% |
| CVE-2025-2328 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient | high | 8.8 | 1% |
| CVE-2013-5988 | all-in-one-seo-pack (WordPress plugin) | A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter. | medium | 6.1 | 1% |
| CVE-2019-14883 | moodle/moodle | Moodle Email media URL tokens were not checking for user status | medium | 5.3 | 1% |
| CVE-2013-7074 | typo3/cms | TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component | low | 3.0 | 1% |
| CVE-2023-2276 | wc-multivendor-membership (WordPress plugin) | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Refer | critical | 9.8 | 1% |
| CVE-2023-5601 | woocommerce-ninja-forms-product-add-ons (WordPress plugin) | The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenti | critical | 9.8 | 1% |
| CVE-2024-6164 | filter-\&-grids (WordPress plugin) | The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possibl | critical | 9.8 | 1% |
| CVE-2019-10186 | moodle/moodle | Moodle CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2017-18122 | simplesamlphp/simplesamlphp | SimpleSAMLphp Signature validation bypass | high | 8.1 | 1% |
| CVE-2023-2518 | easy-forms-for-mailchimp (WordPress plugin) | The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page wh | medium | 6.1 | 1% |