Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-4094 | digits (WordPress plugin) | The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it | critical | 9.8 | 17% |
| CVE-2021-4374 | wordpress-automatic-plugin (WordPress plugin) | The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is du | critical | 9.1 | 16% |
| CVE-2019-8331 | twbs/bootstrap | Bootstrap Vulnerable to Cross-Site Scripting | medium | 6.1 | 16% |
| CVE-2012-6649 | wp-gpx-maps (WordPress plugin) | WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload. | critical | 9.8 | 16% |
| CVE-2015-9499 | showbiz-pro (WordPress plugin) | The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive. | critical | 9.8 | 16% |
| CVE-2018-1042 | moodle/moodle | Moodle SSRF Vulnerability | medium | 6.5 | 16% |
| CVE-2015-5065 | paypal-currency-converter-basic-for-woocommerce (WordPress plugin) | Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plug | medium | 5.0 | 16% |
| CVE-2020-14321 | moodle/moodle | Moodle Incorrect Authorization vulnerability | high | 8.8 | 16% |
| CVE-2023-1347 | customizer-export\/import (WordPress plugin) | The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privile | high | 7.2 | 16% |
| CVE-2021-24276 | contact-form (WordPress plugin) | The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in | medium | 6.1 | 16% |
| CVE-2020-29047 | wp-hotel-booking (WordPress plugin) | The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operati | critical | 9.8 | 16% |
| CVE-2023-6846 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_chec | high | 8.8 | 16% |
| CVE-2021-4428 | autosuggest (WordPress plugin) | A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vul | low | 2.7 | 16% |
| CVE-2020-28032 | WordPress core | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. | critical | 9.8 | 16% |
| CVE-2024-55415 | tcg/voyager | DevDojo Voyager vulnerable to path traversal | high | 0.0 | 16% |
| CVE-2023-4922 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin through 2.2 is vulnerable to a local file inclusion via the `path` parameter. | critical | 9.8 | 16% |
| CVE-2024-6651 | wordpress-file-upload (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.1 | 16% |
| CVE-2015-4694 | zip-attachments (WordPress plugin) | Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read a | high | 8.6 | 16% |
| CVE-2024-31819 | wwbn/avideo | WWBN AVideo Remote Code Execution | critical | 9.8 | 16% |
| CVE-2013-0291 | nextgen-gallery (WordPress plugin) | NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability | high | 7.5 | 16% |
| CVE-2018-8719 | wp-security-audit-log (WordPress plugin) | An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files | medium | 5.3 | 16% |
| CVE-2022-1103 | advanced-uploader (WordPress plugin) | The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, wh | high | 8.8 | 16% |
| CVE-2020-28977 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any inte | medium | 5.3 | 15% |
| CVE-2020-28978 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any inte | medium | 5.3 | 15% |
| CVE-2024-10542 | cleantalk-spam-protect (WordPress plugin) | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due t | critical | 9.8 | 15% |
| CVE-2017-15363 | aoe/restler, luracast/restler | Luracast Restler directory traversal vulnerability | high | 7.5 | 15% |
| CVE-2014-9119 | db-backup (WordPress plugin) | Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbi | medium | 5.0 | 15% |
| CVE-2014-2674 | ajax-pagination (WordPress plugin) | Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary | high | 7.5 | 15% |
| CVE-2018-14028 | WordPress core | In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once | high | 7.2 | 15% |
| CVE-2025-6463 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to | high | 8.8 | 15% |
| CVE-2022-1391 | cab-fare-calculator (WordPress plugin) | The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, whic | critical | 9.8 | 15% |
| CVE-2023-33568 | dolibarr/dolibarr | Dolibarr vulnerable to unauthenticated database access | high | 7.5 | 15% |
| CVE-2022-0747 | infographic-maker (WordPress plugin) | The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement vi | critical | 9.8 | 15% |
| CVE-2019-6799 | phpmyadmin/phpmyadmin | phpMyAdmin Arbitrary file read vulnerability | medium | 5.9 | 15% |
| CVE-2021-21389 | buddypress (WordPress plugin), buddypress/buddypress | BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for | high | 8.1 | 15% |
| CVE-2013-7102 | optimizepress (WordPress theme) | Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php | medium | 6.8 | 15% |
| CVE-2022-0434 | page-view-count (WordPress plugin) | The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement vi | critical | 9.8 | 15% |
| CVE-2020-5776 | dweeves/magmi | Cross-Site Request Forgery in MAGMI | high | 8.8 | 15% |
| CVE-2021-24285 | cars-seller-auto-classifieds-script (WordPress plugin) | The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticat | critical | 9.8 | 15% |
| CVE-2020-10963 | frozennode/administrator | FrozenNode Laravel-Administrator unrestricted file upload | high | 7.2 | 15% |
| CVE-2022-3142 | nex-forms (WordPress plugin) | The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to S | high | 8.8 | 15% |
| CVE-2022-35698 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Stored Cross-Site Scripting (Stored XSS) | critical | 10.0 | 15% |
| CVE-2017-2641 | moodle/moodle | Moodle SQL injection via user preferences | critical | 9.8 | 15% |
| CVE-2006-2667 | WordPress core | Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting | high | 7.5 | 15% |
| CVE-2021-24291 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting ( | medium | 6.1 | 15% |
| CVE-2021-24175 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authe | critical | 9.8 | 14% |
| CVE-2014-8877 | cm-download-manager (WordPress plugin) | The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for | high | 10.0 | 14% |
| CVE-2020-24148 | import-xml-feed (WordPress plugin) | Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a | critical | 9.1 | 14% |
| CVE-2015-2825 | simple-ads-manager (WordPress plugin) | Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote atta | high | 7.5 | 14% |
| CVE-2023-4596 | forminator (WordPress plugin) | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uplo | critical | 9.8 | 14% |