Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-11497 | nab-transact (WordPress plugin) | An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows | high | 7.5 | 1% |
| CVE-2021-20184 | moodle/moodle | Moodle Grade information disclosure in grade's external fetch functions | medium | 4.3 | 1% |
| CVE-2025-3247 | contact-form-7 (WordPress plugin) | The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip | medium | 5.3 | 0% |
| CVE-2025-3479 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions u | medium | 5.3 | 0% |
| CVE-2026-32313 | robrichards/xmlseclibs | xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption | high | 8.2 | 0% |
| CVE-2026-32600 | simplesamlphp/xml-security | simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption | high | 8.2 | 0% |
| GHSA-346h-749j-r28w | mdanter/ecc | PHPECC vulnerable to multiple cryptographic side-channel attacks | critical | 9.1 | – |