Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-39341 | optinmonster (WordPress plugin) | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient aut | high | 8.2 | 22% |
| CVE-2018-8947 | rap2hpoutre/laravel-log-viewer | Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0 | high | 7.5 | 11% |
| CVE-2009-3622 | WordPress core | Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU | medium | 4.3 | 6% |
| CVE-2013-2173 | WordPress core | wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service | medium | 4.3 | 3% |
| CVE-2014-9037 | WordPress core | WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an acc | medium | 6.8 | 3% |
| CVE-2017-14990 | WordPress core | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), | medium | 6.5 | 2% |
| CVE-2022-21829 | concrete5/core | Code injection in concrete CMS | high | 8.0 | 2% |
| CVE-2018-20465 | craftcms/cms | Craft CMS Vulnerable to Server-Side Template Injection | high | 7.2 | 2% |
| CVE-2019-17106 | centreon/centreon | Centreon Sensitive Data Exposure | medium | 6.5 | 1% |
| CVE-2017-6370 | typo3/cms | TYPO3 Information Disclosure Vulnerability | medium | 5.3 | 1% |
| CVE-2021-21339 | typo3/cms, typo3/cms-core | Cleartext storage of session identifier | medium | 5.9 | 1% |
| CVE-2024-22723 | fisharebest/webtrees | Webtrees Path Traversal vulnerability | medium | 4.9 | 1% |
| CVE-2023-5359 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google O | low | 3.7 | 1% |
| CVE-2022-2083 | simple-sign-on (WordPress plugin) | The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorize | high | 7.5 | 1% |
| CVE-2021-39342 | credova-financial (WordPress plugin) | The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX acti | medium | 5.3 | 1% |
| CVE-2019-8118 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Weak Cryptography | medium | 5.3 | 1% |
| CVE-2022-36101 | shopware/shopware | Shopware contains sensitive data in backend customer module | medium | 5.4 | 1% |
| CVE-2020-26228 | typo3/cms, typo3/cms-core | Cleartext storage of session identifier | high | 8.1 | 1% |
| CVE-2022-31046 | typo3/cms, typo3/cms-core | Information Disclosure via Export Module | medium | 4.3 | 1% |
| CVE-2022-3206 | passster (WordPress plugin) | The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is ea | medium | 5.9 | 1% |
| CVE-2022-43691 | concrete5/concrete5 | Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information | medium | 5.3 | 0% |
| CVE-2022-4409 | thorsten/phpmyfaq | phpMyFAQ has insecure HTTP cookies | high | 7.5 | 0% |
| CVE-2023-6250 | like-\&-share (WordPress plugin) | The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a | high | 7.5 | 0% |
| CVE-2024-43429 | moodle/moodle | Moodle has user information visibility control issues in gradebook reports | medium | 5.3 | 0% |
| CVE-2024-43432 | moodle/moodle | Moodle authorization headers preserved between "emulated redirects" | medium | 5.3 | 0% |
| CVE-2024-7713 | chatgpt-assistant (WordPress plugin) | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticat | high | 7.5 | 0% |
| CVE-2023-48707 | codeigniter4/shield | Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication | medium | 5.0 | 0% |
| CVE-2026-33512 | wwbn/avideo | AVideo has an unauthenticated decrypt oracle leaking any ciphertext | high | 7.5 | 0% |
| CVE-2026-55885 | getgrav/grav | Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets | medium | 6.8 | 0% |
| CVE-2026-6553 | typo3/cms-backend | TYPO3 CMS Stores Cleartext Password in User Settings Module | high | 7.5 | 0% |
| CVE-2026-33867 | wwbn/avideo | AVideo has Plaintext Video Password Storage | critical | 0.0 | 0% |
| CVE-2026-55568 | guzzlehttp/guzzle | guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext | medium | 5.9 | 0% |
| CVE-2024-49762 | pterodactyl/panel | Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled | medium | 4.6 | 0% |
| CVE-2024-36119 | statamic/cms | Password confirmation stored in plain text via registration form in statamic/cms | low | 1.8 | 0% |
| CVE-2024-47056 | mautic/core | Mautic does not shield .env files from web traffic | medium | 5.1 | 0% |
| GHSA-ph62-fv59-vf9h | silverstripe/framework | silverstripe/framework users inadvertently passing sensitive data to LoginAttempt | medium | 6.5 | – |