Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2013-3684 | nextgen-gallery (WordPress plugin) | NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload | critical | 9.8 | 19% |
| CVE-2024-7856 | mp3-music-player-by-sonaar (WordPress plugin) | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file dele | high | 8.1 | 19% |
| CVE-2017-16949 | anonymous-post-pro (WordPress plugin) | An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization all | critical | 9.8 | 19% |
| CVE-2018-1000888 | pear/archive_tar | Archive_Tar contains Potential RCE if filename starts with phar:// | high | 8.8 | 19% |
| CVE-2024-32461 | librenms/librenms | LibreNMS vulnerable to SQL injection time-based leads to database extraction | high | 8.8 | 19% |
| CVE-2024-21514 | opencart/opencart | SQL injection in opencart | high | 7.4 | 19% |
| CVE-2022-3900 | cooked (WordPress plugin) | The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in t | critical | 9.8 | 19% |
| CVE-2021-23394 | studio-42/elfinder | elFinder unsafe upload filtering leading to remote code execution | high | 8.1 | 19% |
| CVE-2015-2673 | wp-easycart (WordPress plugin) | The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 th | high | 8.8 | 19% |
| CVE-2018-20556 | booking-calendar (WordPress plugin) | SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the | high | 8.8 | 19% |
| CVE-2025-1025 | cockpit-hq/cockpit | Cockpit Arbitrary File Upload | high | 7.5 | 19% |
| CVE-2015-4414 | se-html5-album-audio-player (WordPress plugin) | Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and ea | medium | 5.0 | 19% |
| CVE-2014-5368 | wp-content-source-control (WordPress plugin) | Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-sourc | medium | 5.0 | 19% |
| CVE-2023-6065 | quttera-web-malware-scanner (WordPress plugin) | The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious acto | medium | 5.3 | 19% |
| CVE-2024-2879 | layerslider (WordPress plugin) | The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to | critical | 9.8 | 18% |
| CVE-2019-9881 | wpgraphql (WordPress plugin) | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even wh | medium | 5.3 | 18% |
| CVE-2022-38916 | pagekit/pagekit | Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type | critical | 9.8 | 18% |
| CVE-2020-35235 | secure-file-manager (WordPress plugin) | vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper acc | high | 8.8 | 18% |
| CVE-2021-24275 | popup (WordPress plugin) | The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attr | medium | 6.1 | 18% |
| CVE-2022-4120 | stop-spammers (WordPress plugin) | The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unseri | critical | 9.8 | 18% |
| CVE-2021-24867 | accessbuddy (WordPress plugin), accesspress-anonymous-post (WordPress plugin), accesspress-basic (WordPress plugin) +90 more | Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only | critical | 9.8 | 18% |
| CVE-2014-8801 | paid-memberships-pro (WordPress plugin) | Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attac | medium | 5.0 | 18% |
| CVE-2023-0234 | siteground-security (WordPress plugin) | The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an a | high | 8.8 | 18% |
| CVE-2023-2288 | otter (WordPress plugin) | The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This le | high | 8.8 | 18% |
| CVE-2024-7855 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() | high | 8.8 | 18% |
| CVE-2022-2551 | duplicator (WordPress plugin) | The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endp | high | 7.5 | 18% |
| CVE-2022-4302 | white-label-cms (WordPress plugin) | The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users su | high | 7.2 | 18% |
| CVE-2022-4324 | custom-field-template (WordPress plugin) | The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injecti | high | 7.2 | 18% |
| CVE-2023-1669 | seopress (WordPress plugin) | The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such | high | 7.2 | 18% |
| CVE-2021-24274 | ultimate-maps (WordPress plugin) | The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in | medium | 6.1 | 18% |
| CVE-2022-4395 | membership-for-woocommerce (WordPress plugin) | The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to up | critical | 9.8 | 18% |
| CVE-2022-2314 | vr-calendar (WordPress plugin) | The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site. | critical | 9.8 | 18% |
| CVE-2023-2833 | reviewx (WordPress plugin) | The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restrict | high | 8.8 | 17% |
| CVE-2025-3914 | aeropage-sync-for-airtable (WordPress plugin) | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aero | high | 8.8 | 17% |
| CVE-2021-24786 | download-monitor (WordPress plugin) | The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQ | high | 7.2 | 17% |
| CVE-2022-4971 | sassy-social-share (WordPress plugin) | The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor | medium | 6.1 | 17% |
| CVE-2022-3416 | wptouch (WordPress plugin) | The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to | high | 7.2 | 17% |
| CVE-2025-24434 | magento/community-edition, magento/project-community-edition | Improper Authorization vulnerability in Magento and Adobe Commerce | critical | 9.1 | 17% |
| CVE-2021-25076 | wp-user-frontend (WordPress plugin) | The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in | high | 8.8 | 17% |
| CVE-2025-55296 | librenms/librenms | LibreNMS allows stored XSS in Alert Template name field | medium | 5.5 | 17% |
| CVE-2014-5337 | wordpress-mobile-pack (WordPress plugin) | The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remo | medium | 5.0 | 17% |
| CVE-2021-3291 | zencart/zencart | Zen Cart vulnerable to authenticated remote code execution | high | 7.2 | 17% |
| CVE-2017-1002008 | membership-simplified-for-oap-members-only (WordPress plugin) | Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for | critical | 9.8 | 17% |
| CVE-2024-0881 | post-grid (WordPress plugin) | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper | medium | 5.4 | 17% |
| CVE-2023-1549 | ad-inserter (WordPress plugin) | The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users suc | high | 7.2 | 17% |
| CVE-2015-3440 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web | medium | 4.3 | 17% |
| CVE-2021-41749 | nystudio107/craft-seomatic | Code Injection in SEOmatic | critical | 9.8 | 17% |
| CVE-2024-6931 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and inc | high | 7.2 | 17% |
| CVE-2020-28337 | microweber/microweber | Zip slip in Microweber | high | 7.2 | 17% |
| CVE-2024-8669 | backuply (WordPress plugin) | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to | critical | 9.1 | 17% |