Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-28037 | WordPress core | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which | critical | 9.8 | 8% |
| CVE-2024-3729 | acf-frontend-form-element (WordPress plugin) | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' | critical | 9.8 | 1% |
| CVE-2023-0572 | froxlor/froxlor | Froxlor contains Unchecked Error Condition | medium | 5.3 | 1% |
| CVE-2023-34099 | shopware/shopware | Shopware improper mail validation vulnerability | medium | 5.3 | 1% |
| CVE-2024-4611 | apppresser (WordPress plugin) | The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCoo | high | 8.1 | 1% |
| CVE-2023-6742 | envira-gallery-lite (WordPress plugin) | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an im | medium | 4.3 | 0% |
| CVE-2025-13080 | drupal/core | Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HT | low | 0.0 | 0% |
| CVE-2024-43435 | moodle/moodle | Moodle has insufficient capability checks | medium | 5.3 | 0% |
| CVE-2026-41662 | admidio/admidio | Admidio Missing Minimum Administrator Check in Role Membership Removal | medium | 5.2 | 0% |