Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-28037 | WordPress core | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which | critical | 9.8 | 8% |
| CVE-2021-39174 | cachethq/cachet | Cachet configuration leak | high | 8.8 | 5% |
| CVE-2024-29686 | wintercms/winter | Winter CMS Server-Side Template Injection (SSTI) vulnerability | high | 8.8 | 2% |
| CVE-2024-3729 | acf-frontend-form-element (WordPress plugin) | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' | critical | 9.8 | 1% |
| CVE-2023-1430 | fluent-crm (WordPress plugin) | The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up t | medium | 6.5 | 1% |
| CVE-2011-4625 | simplesamlphp/simplesamlphp | simpleSAMLphp incorrectly handles XML encryption | high | 7.5 | 1% |
| CVE-2023-0572 | froxlor/froxlor | Froxlor contains Unchecked Error Condition | medium | 5.3 | 1% |
| CVE-2023-34099 | shopware/shopware | Shopware improper mail validation vulnerability | medium | 5.3 | 1% |
| CVE-2023-1758 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter | high | 8.9 | 1% |
| CVE-2024-4611 | apppresser (WordPress plugin) | The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCoo | high | 8.1 | 1% |
| CVE-2023-6599 | microweber/microweber | Microweber missing standardized error handling mechanism | low | 3.1 | 0% |
| CVE-2023-6742 | envira-gallery-lite (WordPress plugin) | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an im | medium | 4.3 | 0% |
| CVE-2024-9940 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to | medium | 5.3 | 0% |
| CVE-2025-13080 | drupal/core | Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HT | low | 0.0 | 0% |
| CVE-2024-43435 | moodle/moodle | Moodle has insufficient capability checks | medium | 5.3 | 0% |
| CVE-2026-41662 | admidio/admidio | Admidio Missing Minimum Administrator Check in Role Membership Removal | medium | 5.2 | 0% |
| CVE-2026-48747 | symfony/mailomat-mailer, symfony/symfony | Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade | medium | 0.0 | 0% |