Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-18580 | shortcodes-ultimate (WordPress plugin) | The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode. | critical | 9.8 | 12% |
| CVE-2012-4399 | cakephp/cakephp | CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references | high | 7.5 | 12% |
| CVE-2024-8529 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1 | critical | 10.0 | 12% |
| CVE-2022-2552 | duplicator (WordPress plugin) | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such | medium | 5.3 | 12% |
| CVE-2008-5695 | WordPress core | wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, | high | 8.5 | 12% |
| CVE-2021-24915 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name | critical | 9.8 | 12% |
| CVE-2024-34051 | dolibarr/dolibarr | Reflected Cross-Site Scripting (XSS) in Dolibarr | medium | 0.0 | 12% |
| CVE-2020-8417 | code-snippets (WordPress plugin) | The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu. | high | 8.8 | 12% |
| CVE-2015-1375 | pixabay-images (WordPress plugin) | pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, whic | high | 7.5 | 12% |
| CVE-2021-42325 | froxlor/froxlor | Froxlor SQL injection vulnerability | critical | 9.8 | 12% |
| CVE-2024-6028 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and i | critical | 9.8 | 12% |
| CVE-2007-0107 | WordPress core | WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote | medium | 6.8 | 12% |
| CVE-2007-0233 | WordPress core | wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a va | high | 7.5 | 12% |
| CVE-2016-10924 | ebook-download (WordPress plugin) | The ebook-download plugin before 1.2 for WordPress has directory traversal. | high | 7.5 | 12% |
| CVE-2022-0817 | badgeos (WordPress plugin) | The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, l | critical | 9.8 | 12% |
| CVE-2014-9014 | wpmarketplace (WordPress plugin) | Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for Word | medium | 4.3 | 12% |
| CVE-2022-0952 | sitemap (WordPress plugin) | The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, | high | 8.8 | 11% |
| CVE-2019-15889 | download-manager (WordPress plugin) | The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search | medium | 6.1 | 11% |
| CVE-2022-1392 | videos-sync-pdf (WordPress plugin) | The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could le | high | 7.5 | 11% |
| CVE-2021-24488 | post-grid (WordPress plugin) | The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before | medium | 6.1 | 11% |
| CVE-2004-1584 | WordPress core | CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify e | medium | 5.0 | 11% |
| CVE-2023-23489 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in th | critical | 9.8 | 11% |
| CVE-2017-1002001 | mobile-app-builder-by-wappress (WordPress plugin) | Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://w | critical | 9.8 | 11% |
| CVE-2024-1061 | html5-video-player (WordPress plugin) | The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parame | high | 8.6 | 11% |
| CVE-2014-9260 | download-manager (WordPress plugin) | The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every Word | high | 8.8 | 11% |
| CVE-2018-8947 | rap2hpoutre/laravel-log-viewer | Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0 | high | 7.5 | 11% |
| CVE-2019-15821 | bold-page-builder (WordPress plugin) | The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data. | high | 7.5 | 11% |
| CVE-2021-24507 | astra (WordPress plugin) | The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_ | critical | 9.8 | 11% |
| CVE-2024-6497 | squirrly-seo (WordPress plugin) | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up | high | 8.8 | 11% |
| CVE-2022-2073 | getgrav/grav | Code injection in grav | high | 7.2 | 11% |
| CVE-2020-11529 | getgrav/grav | Open Redirect in Grav | medium | 6.1 | 11% |
| CVE-2020-11514 | seo-by-rank-math (WordPress plugin) | The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, includin | critical | 9.8 | 11% |
| CVE-2015-2196 | spider-calendar (WordPress plugin) | SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the c | high | 7.5 | 11% |
| CVE-2023-5674 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading | high | 8.8 | 11% |
| CVE-2022-0760 | simple-link-directory (WordPress plugin) | The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statemen | critical | 9.8 | 11% |
| CVE-2021-24320 | bello (WordPress plugin) | The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field | medium | 6.1 | 11% |
| CVE-2020-8615 | tutor-lms (WordPress plugin) | A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and | medium | 6.5 | 11% |
| CVE-2021-24405 | easy-cookies-policy (WordPress plugin) | The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authe | medium | 6.5 | 11% |
| CVE-2019-12922 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-Site Request Forgery (CSRF) | medium | 6.5 | 11% |
| CVE-2017-15806 | zetacomponents/mail | Zeta Components Mail Arbitrary code execution via a crafted email address | high | 8.1 | 11% |
| CVE-2024-1538 | wp-file-manager (WordPress plugin) | The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due t | high | 8.8 | 11% |
| CVE-2014-1889 | buddypress (WordPress plugin) | The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrar | medium | 6.5 | 11% |
| CVE-2021-24300 | product-slider-for-woocommerce (WordPress plugin) | The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitise | medium | 6.1 | 11% |
| CVE-2016-10956 | mail-masta (WordPress plugin) | The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php. | high | 7.5 | 11% |
| CVE-2020-26876 | wp-courses (WordPress plugin) | The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materi | high | 7.5 | 11% |
| CVE-2021-26598 | impresscms/impresscms | Incorrect Access Control in ImpressCMS | medium | 5.3 | 11% |
| CVE-2008-1502 | moodle/moodle | Moodle vulnerable to Cross-site scripting | medium | 0.0 | 11% |
| CVE-2022-0281 | microweber/microweber | Exposure of Sensitive Information to an Unauthorized Actor in microweber | high | 7.5 | 10% |
| CVE-2012-4768 | download-monitor (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbit | medium | 4.3 | 10% |
| CVE-2015-6830 | phpmyadmin/phpmyadmin | phpMyAdmin ReCaptcha bypass | medium | 0.0 | 10% |