Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-21518 | opencart/opencart | Zip slip in opencart | high | 7.2 | 14% |
| CVE-2024-55417 | tcg/voyager | DevDojo Voyager Arbitrary File Write | medium | 4.3 | 14% |
| CVE-2023-6620 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL stateme | high | 7.2 | 14% |
| CVE-2015-2068 | dweeves/magmi | MAGMI cross-site scripting (XSS) | medium | 0.0 | 14% |
| CVE-2020-3716 | magento/community-edition | Magento deserialization vulnerability | critical | 9.8 | 14% |
| CVE-2019-3810 | moodle/moodle | Moodle XSS Vulnerability | medium | 5.3 | 14% |
| CVE-2014-9473 | cforms2 (WordPress plugin) | Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to e | high | 7.5 | 14% |
| CVE-2021-43008 | vrana/adminer | Files or Directories Accessible to External Parties in Adminer | high | 7.5 | 14% |
| CVE-2024-11728 | kivicare-clinic-management-system (WordPress plugin) | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' | high | 7.5 | 14% |
| CVE-2020-11027 | WordPress core | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be | medium | 6.1 | 14% |
| CVE-2020-13405 | microweber/microweber | Microweber Discloses Sensitive Information | high | 7.5 | 14% |
| CVE-2022-0595 | drag-and-drop-multiple-file-upload---contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_uplo | medium | 5.4 | 14% |
| CVE-2014-5465 | download-shortcode (WordPress plugin) | Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attac | medium | 5.0 | 14% |
| CVE-2022-45359 | yith-woocommerce-gift-cards (WordPress plugin) | Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress. | critical | 9.8 | 14% |
| CVE-2020-13700 | acf-to-rest-api (WordPress plugin), airesvsg/acf-to-rest-api | An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permali | high | 7.5 | 13% |
| CVE-2022-0867 | pricing-table (WordPress plugin) | The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolate | critical | 9.8 | 13% |
| CVE-2015-4153 | zm-ajax-login-register (WordPress plugin) | Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and e | medium | 5.0 | 13% |
| CVE-2015-2791 | wpml (WordPress plugin) | The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus v | medium | 6.4 | 13% |
| CVE-2022-0786 | kivicare (WordPress plugin) | The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_pos | critical | 9.8 | 13% |
| CVE-2026-33478 | wwbn/avideo | AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection | critical | 10.0 | 13% |
| CVE-2018-18069 | wpml (WordPress plugin) | process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (s | medium | 6.1 | 13% |
| CVE-2018-20463 | jsmol2wp (WordPress plugin) | An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal | high | 7.5 | 13% |
| CVE-2022-2840 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements | critical | 9.8 | 13% |
| CVE-2020-24948 | autoptimize (WordPress plugin) | The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing | high | 7.2 | 13% |
| CVE-2022-0781 | nirweb-support (WordPress plugin) | The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX act | critical | 9.8 | 13% |
| CVE-2021-38556 | billz/raspap-webgui | Command Injection in RaspAP 2.6.6 | high | 8.8 | 13% |
| CVE-2015-1365 | pixabay-images (WordPress plugin) | Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to wri | medium | 5.0 | 13% |
| CVE-2013-2009 | wp-super-cache (WordPress plugin) | WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution | high | 8.8 | 13% |
| CVE-2025-27892 | shopware/core, shopware/platform | Shopware Vulnerable to Blind SQL-injection in DAL aggregations | high | 7.3 | 13% |
| CVE-2020-29395 | eventon (WordPress plugin) | The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. | medium | 6.1 | 13% |
| CVE-2011-2505 | phpmyadmin/phpmyadmin | phpMyAdmin remote variable manipulation | medium | 0.0 | 13% |
| CVE-2022-1768 | rsvpmaker (WordPress plugin) | The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user | critical | 9.8 | 13% |
| CVE-2021-24926 | domain-check (WordPress plugin) | The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, lea | medium | 6.1 | 13% |
| CVE-2013-1916 | user-photo (WordPress plugin) | In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on th | high | 8.8 | 13% |
| CVE-2015-2826 | simple-ads-manager (WordPress plugin) | WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. | medium | 5.3 | 13% |
| CVE-2015-9480 | robotcpa (WordPress plugin) | The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter. | high | 7.5 | 13% |
| CVE-2025-62411 | librenms/librenms | LibreNMS has a Stored XSS vulnerability in its Alert Transport name field | medium | 5.5 | 13% |
| CVE-2011-4107 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to XML external entity (XXE) injection attack | medium | 6.5 | 13% |
| CVE-2021-24286 | redirect-404-to-parent (WordPress plugin) | The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting | medium | 6.1 | 13% |
| CVE-2017-1002002 | webapp-builder (WordPress plugin) | Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/ | critical | 9.8 | 13% |
| CVE-2020-13640 | wpdiscuz (WordPress plugin) | A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL comma | critical | 9.8 | 13% |
| CVE-2021-24827 | asgaros-forum (WordPress plugin) | The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a S | critical | 9.8 | 13% |
| CVE-2017-5630 | pear/pear | PEAR core file overwrite vulnerability | high | 7.5 | 13% |
| CVE-2024-9593 | time-clock (WordPress plugin) | The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2. | high | 8.3 | 12% |
| CVE-2020-26248 | prestashop/productcomments | Blind SQL injection in PrestaShop productcomments module | high | 8.2 | 12% |
| CVE-2017-14719 | WordPress core | Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip componen | high | 7.5 | 12% |
| CVE-2017-1002003 | wp2android-turn-wp-site-into-android-app (WordPress plugin) | Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software fr | critical | 9.8 | 12% |
| CVE-2022-1574 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as | critical | 9.8 | 12% |
| CVE-2019-6341 | drupal/core, drupal/drupal | Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross- | medium | 5.4 | 12% |
| CVE-2018-19040 | media-file-manager (WordPress plugin) | The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocat | medium | 5.3 | 12% |