Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-69200 | thorsten/phpmyfaq | phpMyFAQ has unauthenticated config backup download via /api/setup/backup | high | 7.5 | 2% |
| CVE-2021-32711 | shopware/platform | Exposure of Sensitive Information to an Unauthorized Actor | critical | 9.1 | 1% |
| CVE-2022-41623 | dropshipping-and-fulfillment-for-aliexpress-and-woocommerce (WordPress plugin) | Sensitive Data Exposure in Villatheme ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 on WordPress. | high | 7.5 | 1% |
| CVE-2023-7072 | post-grid (WordPress plugin) | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i | high | 7.5 | 1% |
| CVE-2025-68456 | craftcms/cms | Unauthenticated Craft CMS users can trigger a database backup | high | 0.0 | 1% |
| CVE-2024-1287 | paid-memberships-pro (WordPress plugin) | The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' | medium | 6.5 | 1% |
| CVE-2024-2088 | social-networks-auto-poster-facebook-twitter-g (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | high | 8.5 | 0% |