Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-4616 | easy2map (WordPress plugin) | Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers | medium | 5.0 | 10% |
| CVE-2018-20555 | social-network-tabs (WordPress plugin) | The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_se | critical | 9.8 | 10% |
| CVE-2022-1692 | cp-image-store-with-slideshow (WordPress plugin) | The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using i | critical | 9.8 | 10% |
| CVE-2021-24287 | select-all-categories-and-taxonomies\,-change-checkbox-to-radio-buttons (WordPress plugin) | The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not proper | medium | 6.1 | 10% |
| CVE-2024-4443 | business-directory-plugin (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via th | critical | 9.8 | 10% |
| CVE-2021-24169 | advanced-order-export-for-woocommerce (WordPress plugin) | This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab paramete | medium | 6.1 | 10% |
| CVE-2017-5611 | WordPress core | SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbit | critical | 9.8 | 10% |
| CVE-2022-4063 | inpost-gallery (WordPress plugin) | The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to | critical | 9.8 | 10% |
| CVE-2022-0592 | mapsvg (WordPress plugin) | The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, l | critical | 9.8 | 10% |
| CVE-2024-4295 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, | critical | 9.8 | 10% |
| CVE-2015-5469 | mdc-youtube-downloader (WordPress plugin) | Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary fil | high | 7.5 | 10% |
| CVE-2025-47931 | librenms/librenms | LibreNMS stored Cross-site Scripting vulnerability in poller group name | low | 0.0 | 10% |
| CVE-2015-9538 | nextgen-gallery (WordPress plugin) | The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection. | medium | 6.5 | 10% |
| CVE-2015-6668 | job-manager (WordPress plugin) | The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload dir | high | 7.5 | 10% |
| CVE-2022-0784 | title-experiments-free (WordPress plugin) | The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement vi | critical | 9.8 | 10% |
| CVE-2010-0682 | WordPress core | WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p p | medium | 4.0 | 10% |
| CVE-2018-19042 | media-file-manager (WordPress plugin) | The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to pa | medium | 5.3 | 10% |
| CVE-2018-19043 | media-file-manager (WordPress plugin) | The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory | medium | 5.3 | 10% |
| CVE-2020-8658 | htaccess (WordPress plugin) | The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The fla | high | 8.8 | 10% |
| CVE-2022-0948 | order-listener-for-woocommerce (WordPress plugin) | The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL stat | critical | 9.8 | 10% |
| CVE-2015-5161 | zendframework/zendframework, zendframework/zendframework1, zendframework/zendxml | ZendXml and Zend Framework contain XXE and XEE Vulnerabilities | medium | 0.0 | 10% |
| CVE-2021-24647 | pie-register (WordPress plugin) | The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1. | high | 8.1 | 10% |
| CVE-2020-36155 | ultimate-member (WordPress plugin) | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. A | critical | 10.0 | 10% |
| CVE-2014-1905 | videowhisper-live-streaming-integration (WordPress plugin) | Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPr | high | 10.0 | 10% |
| CVE-2020-27481 | good-learning-management-system (WordPress plugin) | An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPr | critical | 9.8 | 10% |
| CVE-2019-16902 | arforms (WordPress plugin) | In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by s | high | 7.5 | 10% |
| CVE-2015-2213 | WordPress core | SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attacke | high | 7.5 | 10% |
| CVE-2021-43408 | copy-delete-posts (WordPress plugin) | The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur | medium | 6.5 | 10% |
| CVE-2011-2506 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to static code injection | high | 0.0 | 10% |
| CVE-2021-29625 | vrana/adminer | XSS in doc_link | high | 7.5 | 10% |
| CVE-2025-2594 | user-registration-\&-membership (WordPress plugin) | The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon | high | 8.1 | 10% |
| CVE-2022-0885 | member-hero (WordPress plugin) | The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, | critical | 9.8 | 9% |
| CVE-2019-17574 | popup-maker (WordPress plugin) | An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the argumen | critical | 9.1 | 9% |
| CVE-2024-8253 | post-grid (WordPress plugin) | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due | high | 8.8 | 9% |
| CVE-2026-32267 | craftcms/cms | Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() | high | 0.0 | 9% |
| CVE-2015-1000012 | mypixs (WordPress plugin) | Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin | high | 7.5 | 9% |
| CVE-2005-2108 | WordPress core | SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via | high | 7.5 | 9% |
| CVE-2022-26149 | modx/revolution | Unrestricted Upload of File with Dangerous Type in MODX Revolution | high | 7.2 | 9% |
| CVE-2015-4062 | newstatpress (WordPress plugin) | SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated use | medium | 6.5 | 9% |
| CVE-2024-45440 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal Full Path Disclosure | medium | 5.3 | 9% |
| CVE-2016-10972 | newspaper (WordPress theme) | The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel. | critical | 9.8 | 9% |
| CVE-2019-6112 | sell-media (WordPress plugin) | A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to | medium | 6.1 | 9% |
| CVE-2022-3180 | wpgateway (WordPress plugin) | The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated | critical | 9.8 | 9% |
| CVE-2011-4898 | WordPress core | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacki | medium | 5.0 | 9% |
| CVE-2014-0166 | WordPress core | The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determi | medium | 6.4 | 9% |
| CVE-2007-6318 | WordPress core | SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL command | medium | 6.8 | 9% |
| CVE-2014-3848 | imember360 (WordPress plugin) | The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database crede | medium | 5.0 | 9% |
| CVE-2025-53833 | binarytorch/larecipe | LaRecipe is vulnerable to Server-Side Template Injection attacks | critical | 10.0 | 9% |
| CVE-2022-0826 | wp-video-gallery-free (WordPress plugin) | The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX | critical | 9.8 | 9% |
| CVE-2022-0827 | bestbooks (WordPress plugin) | The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX a | critical | 9.8 | 9% |