Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-24733 | sylius/sylius | Improper Restriction of Rendered UI Layers or Frames in Sylius | medium | 6.1 | 1% |
| CVE-2023-38873 | gugoan/economizzer | Economizzer vulnerable to Clickjacking | medium | 6.5 | 1% |
| CVE-2020-5679 | ec-cube/ec-cube | EC-CUBE Improper Restriction of Rendered UI Layers or Frames | medium | 6.1 | 1% |
| CVE-2021-3734 | yourls/yourls | Improper Restriction of Rendered UI Layers or Frames in yourls | medium | 6.5 | 0% |
| CVE-2023-0780 | cockpit-hq/cockpit | Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit | medium | 5.4 | 0% |
| CVE-2025-54139 | elmsln/haxcms | HAX CMS application pages vulnerable to clickjacking | medium | 4.3 | 0% |
| CVE-2025-63522 | feehi/feehicms | FeehiCMS is vulnerable to reverse tabnabbing | medium | 4.6 | 0% |