Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2013-2011 | w3-super-cache (WordPress plugin) | WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitr | high | 8.8 | 5% |
| CVE-2022-0210 | random-banner (WordPress plugin) | The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter foun | medium | 4.8 | 4% |
| CVE-2020-13625 | phpmailer/phpmailer | Insufficient output escaping of attachment names in PHPMailer | high | 7.5 | 4% |
| CVE-2019-11325 | symfony/symfony, symfony/var-exporter | Improper Input Validation in Symfony | critical | 9.8 | 3% |
| CVE-2022-0220 | wordpress-gdpr\&ccpa (WordPress plugin) | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authentic | medium | 6.1 | 2% |
| CVE-2019-12463 | librenms/librenms | Improper Encoding or Escaping of Output and Injection in LibreNMS | high | 8.8 | 1% |
| CVE-2021-39170 | pimcore/pimcore | Improper Encoding or Escaping of Output in Asset Metadata Component | high | 8.0 | 1% |
| CVE-2020-10960 | mediawiki/core | MediaWiki makeCollapsible allows applying event handler to any CSS selector | medium | 5.3 | 1% |
| CVE-2020-36173 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. | medium | 5.3 | 1% |
| CVE-2025-46347 | yeswiki/yeswiki | YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution | high | 0.0 | 1% |
| CVE-2023-3668 | froxlor/froxlor | Froxlor vulnerable to Improper Encoding or Escaping of Output | critical | 9.1 | 1% |
| CVE-2021-40694 | moodle/moodle | Moodle Improper Encoding or Escaping of Output | medium | 4.9 | 1% |
| CVE-2019-19714 | contao/contao, contao/core-bundle | Insert tag injection in the Contao login module | medium | 5.3 | 1% |
| CVE-2022-22734 | simple-quotation (WordPress plugin) | The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and esca | medium | 6.1 | 1% |
| CVE-2026-54182 | backpack/crud | Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) | high | 8.1 | 1% |
| CVE-2022-2099 | woocommerce (WordPress plugin), woocommerce/woocommerce | The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment g | medium | 4.8 | 1% |
| CVE-2022-2241 | featured-image-from-url (WordPress plugin) | The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could a | medium | 6.1 | 1% |
| CVE-2022-0450 | menu-image\,-icons-made-easy (WordPress plugin) | The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and doe | medium | 5.4 | 1% |
| CVE-2024-34355 | typo3/cms-core | TYPO3 vulnerable to an HTML Injection in the History Module | low | 3.5 | 1% |
| CVE-2022-0421 | five-star-restaurant-reservations (WordPress plugin) | The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was success | medium | 6.1 | 1% |
| CVE-2023-3552 | nilsteampassnet/teampass | TeamPass vulnerable to Improper Encoding or Escaping of Output | high | 7.6 | 1% |
| CVE-2026-55891 | privatebin/privatebin | PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI | low | 0.0 | 1% |
| CVE-2023-3190 | nilsteampassnet/teampass | Teampass Cross-site Scripting vulnerability | medium | 4.6 | 1% |
| CVE-2023-39527 | prestashop/prestashop | PrestaShop XSS injection through Validate::isCleanHTML method | high | 8.3 | 1% |
| CVE-2026-54133 | mtdowling/jmespath.php | jmespath.php has CompilerRuntime code injection via unescaped function names | critical | 9.8 | 0% |
| CVE-2023-6005 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which co | medium | 4.8 | 0% |
| CVE-2024-47528 | librenms/librenms | LibreNMS vulnerable to Stored Cross-site Scripting via File Upload | medium | 4.8 | 0% |
| CVE-2024-0233 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outp | medium | 6.1 | 0% |
| CVE-2024-39682 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1 | medium | 6.4 | 0% |
| CVE-2026-52772 | yeswiki/yeswiki | YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html')) | medium | 5.5 | 0% |
| CVE-2026-46637 | twig/cssinliner-extra, twig/markdown-extra | Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` | low | 0.0 | 0% |
| CVE-2026-46628 | twig/twig | Twig: The `spaceless` filter implicitly marks its output as safe | low | 0.0 | 0% |
| CVE-2026-107845 | contao/comments-bundle | Contao: Cross-site scripting in the comments bundle | critical | 9.3 | 0% |
| CVE-2026-27016 | librenms/librenms | LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags() | medium | 5.4 | 0% |
| CVE-2026-46367 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering | high | 7.6 | 0% |
| CVE-2026-33628 | invoiceninja/invoiceninja | Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items | medium | 5.4 | 0% |
| CVE-2026-31859 | craftcms/cms | CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization | medium | 0.0 | 0% |
| GHSA-crmm-hgp2-wgrp | laravel/framework | Laravel Framework: Temporary Signed URL Path Confusion | medium | 4.2 | – |
| CVE-2026-45710 | facturascripts/facturascripts | FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes i | low | 3.5 | – |
| GHSA-6jq6-x4cx-qvcm | grumpydictator/firefly-iii | Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig) | medium | 0.0 | – |