Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-5385 | amphp/artax, bugsnag/bugsnag-laravel, drupal/core +4 more | HTTP Proxy header vulnerability | high | 8.1 | 50% |
| CVE-2020-11529 | getgrav/grav | Open Redirect in Grav | medium | 6.1 | 11% |
| CVE-2019-6780 | wise-chat (WordPress plugin) | The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noo | medium | 6.1 | 5% |
| CVE-2022-0165 | kingcomposer (WordPress plugin) | The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc | medium | 6.1 | 4% |
| CVE-2022-0692 | rudloff/alltube | Open Redirect in AllTube | medium | 6.1 | 3% |
| CVE-2021-24210 | phastpress (WordPress plugin) | There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the pl | medium | 6.1 | 3% |
| CVE-2021-24406 | wpforo-forum (WordPress plugin) | The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open | medium | 6.1 | 3% |
| CVE-2018-10101 | WordPress core | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. | medium | 6.1 | 3% |
| CVE-2018-10100 | WordPress core | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. | medium | 6.1 | 3% |
| CVE-2022-0597 | microweber/microweber | Open redirect in microweber | medium | 6.1 | 3% |
| CVE-2019-16220 | WordPress core | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open r | medium | 6.1 | 3% |
| CVE-2020-11515 | seo-by-rank-math (WordPress plugin) | The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external | medium | 6.1 | 3% |
| CVE-2013-1843 | typo3/cms-core | TYPO3 Open redirect vulnerability in the Access tracking mechanism | medium | 5.3 | 2% |
| CVE-2021-25033 | noptin (WordPress plugin) | The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given va | medium | 6.1 | 2% |
| CVE-2021-24358 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted UR | medium | 6.1 | 2% |
| CVE-2021-24838 | anycomment (WordPress plugin) | The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() fun | medium | 6.1 | 2% |
| CVE-2017-14725 | WordPress core | Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. | medium | 5.4 | 2% |
| CVE-2021-25074 | webp-converter-for-media (WordPress plugin) | The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before r | medium | 6.1 | 2% |
| CVE-2019-15774 | nd-booking (WordPress plugin) | The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | medium | 6.1 | 2% |
| CVE-2015-3880 | phpbb/phpbb | phpBB Open Redirect | medium | 6.1 | 2% |
| CVE-2015-5062 | silverstripe/cms, silverstripe/framework | Silverstripe CMS Open Redirect | medium | 0.0 | 2% |
| CVE-2019-15816 | wp-private-content-plus (WordPress plugin) | The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ | high | 7.5 | 2% |
| CVE-2020-4048 | WordPress core | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted | medium | 5.7 | 2% |
| CVE-2021-25028 | event-tickets (WordPress plugin) | The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the | medium | 6.1 | 2% |
| CVE-2021-25111 | english-wordpress-admin (WordPress plugin) | The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o | medium | 6.1 | 2% |
| CVE-2011-1941 | phpmyadmin/phpmyadmin | phpMyAdmin Open Redirect in redirector | medium | 0.0 | 2% |
| CVE-2015-3175 | moodle/moodle | Moodle Arbitrary Redirect | medium | 0.0 | 2% |
| CVE-2017-9062 | WordPress core | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. | high | 8.6 | 2% |
| CVE-2021-24165 | ninja-forms (WordPress plugin) | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due | medium | 6.1 | 2% |
| CVE-2018-19796 | ninja-forms (WordPress plugin) | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessi | medium | 6.1 | 2% |
| CVE-2019-19709 | mediawiki/core | Possible to circumvent title-blacklist | medium | 6.1 | 2% |
| CVE-2011-4294 | moodle/moodle | Moodle Open Redirect Via Error Messages | medium | 0.0 | 2% |
| CVE-2016-9451 | drupal/core | Drupal Open Redirect | medium | 6.8 | 2% |
| CVE-2018-19790 | symfony/security, symfony/security-http, symfony/symfony | Symfony Open Redirect | medium | 6.1 | 1% |
| CVE-2017-2217 | download-manager (WordPress plugin) | Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web | medium | 6.1 | 1% |
| CVE-2019-15818 | simple-301-redirects-addon-bulk-uploader (WordPress plugin) | The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301expo | medium | 6.1 | 1% |
| CVE-2019-15820 | login-or-logout-menu-item (WordPress plugin) | The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication. | medium | 6.1 | 1% |
| CVE-2015-8760 | typo3/cms | TYPO3 allows remote attackers to embed Flash videos from external domain | medium | 6.1 | 1% |
| CVE-2020-10959 | mediawiki/core | MediaWiki Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2015-4070 | wow-moodboard-lite (WordPress plugin) | Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote | medium | 6.1 | 1% |
| CVE-2008-4104 | joomla/framework | Joomla! Open Redirect vulnerability | medium | 0.0 | 1% |
| CVE-2012-1589 | drupal/drupal | Drupal Open Redirect | medium | 0.0 | 1% |
| CVE-2016-3167 | drupal/core, drupal/drupal | Drupal Open redirect vulnerability in the drupal_goto function | high | 7.4 | 1% |
| CVE-2019-15772 | nd-donations (WordPress plugin) | The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | medium | 6.1 | 1% |
| CVE-2019-15773 | nd-travel (WordPress plugin) | The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | medium | 6.1 | 1% |
| CVE-2019-15775 | nd-learning (WordPress plugin) | The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | medium | 6.1 | 1% |
| CVE-2019-15776 | simple-301-redirects-addon-bulk-uploader (WordPress plugin) | The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a C | medium | 6.1 | 1% |
| CVE-2018-16191 | ec-cube/ec-cube | EC-CUBE Open redirect vulnerability | medium | 6.1 | 1% |
| CVE-2024-0250 | analytics-insights (WordPress plugin) | The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validati | medium | 6.1 | 1% |
| CVE-2013-6389 | drupal/drupal | Drupal has open redirect vulnerability in the Overlay module | high | 7.5 | 1% |