Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-35234 | easy-wp-smtp (WordPress plugin) | The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an a | high | 7.5 | 60% |
| CVE-2018-8719 | wp-security-audit-log (WordPress plugin) | An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files | medium | 5.3 | 16% |
| CVE-2018-0504 | mediawiki/core | Mediawiki information disclosure vulnerability | medium | 6.5 | 3% |
| CVE-2018-7204 | file-manager (WordPress plugin) | inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/fi | high | 7.5 | 3% |
| CVE-2018-10889 | moodle/moodle | Moodle sensitive information disclosure | medium | 5.3 | 2% |
| CVE-2012-1156 | moodle/moodle | Moodle backs up private files | high | 7.5 | 2% |
| CVE-2018-7433 | better-wp-security (WordPress plugin) | The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page. | high | 7.5 | 1% |
| CVE-2021-25009 | correosexpress (WordPress plugin) | The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such | medium | 5.3 | 1% |
| CVE-2022-31047 | typo3/cms, typo3/cms-core | Insertion of Sensitive Information into Log File in typo3/cms-core | medium | 5.3 | 1% |
| CVE-2020-11094 | rainlab/debugbar-plugin | Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar | medium | 6.1 | 1% |
| CVE-2021-32767 | typo3/cms, typo3/cms-core | Information Disclosure in User Authentication | medium | 5.3 | 1% |
| CVE-2024-6451 | ai-engine (WordPress plugin) | AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to vali | high | 7.2 | 1% |
| CVE-2021-37709 | shopware/core, shopware/platform | Insecure direct object reference of log files of the Import/Export feature | medium | 6.5 | 1% |
| CVE-2023-22733 | shopware/core, shopware/platform | Shopware's log module vulnerable to Improper Output Neutralization | low | 2.7 | 1% |
| CVE-2023-6064 | payhere-payment-gateway (WordPress plugin) | The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive informat | high | 7.5 | 1% |
| CVE-2020-5225 | simplesamlphp/simplesamlphp | Log injection in SimpleSAMLphp | medium | 4.4 | 1% |
| CVE-2021-32050 | mongodb/mongodb | MongoDB Driver may publish events containing authentication-related data | medium | 4.2 | 1% |
| CVE-2023-48708 | codeigniter4/shield | Insertion of Sensitive Information into Log | medium | 5.0 | 1% |
| CVE-2024-2302 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to | medium | 5.3 | 1% |
| CVE-2022-41618 | media-library-assistant (WordPress plugin) | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. | low | 3.7 | 1% |
| CVE-2024-31247 | fg-drupal (WordPress plugin) | Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to Wor | medium | 5.3 | 1% |
| CVE-2024-13818 | pie-register (WordPress plugin) | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction p | medium | 5.3 | 1% |
| CVE-2023-51408 | wp-optin-wheel (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Too | medium | 5.3 | 0% |
| CVE-2024-31254 | backup-and-migration (WordPress plugin) | Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup | low | 3.7 | 0% |
| CVE-2024-47913 | mediawiki/abuse-filter | Improper permissions handling in MediaWiki AbuseFilter | medium | 5.3 | 0% |
| CVE-2026-23493 | pimcore/pimcore | Pimcore ENV Variables and Cookie Informations are exposed in http_error_log | high | 8.6 | 0% |
| CVE-2024-6687 | ctt-expresso-para-woocommerce (WordPress plugin) | The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3 | medium | 5.3 | 0% |
| CVE-2025-48493 | yiisoft/yii2-redis | Yii 2 Redis may expose AUTH parameters in logs in case of connection failure | medium | 0.0 | 0% |
| CVE-2024-55891 | typo3/cms-install | TYPO3 Information Disclosure via Exception Handling/Logger | low | 3.1 | 0% |
| CVE-2026-47234 | admidio/admidio | Admidio writes session IDs and auto-login cookie values to application logs | medium | 4.4 | 0% |
| CVE-2026-59947 | composer/composer | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) | medium | 4.7 | 0% |
| GHSA-q683-8468-r6h6 | web-auth/webauthn-symfony-bundle | WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs | medium | 0.0 | – |