Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-3301 | thecartpress (WordPress plugin) | Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for W | medium | 4.0 | 9% |
| CVE-2012-3414 | WordPress core | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image | medium | 4.3 | 9% |
| CVE-2024-9707 | hunk-companion (WordPress plugin) | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on th | critical | 9.8 | 9% |
| CVE-2013-4338 | WordPress core | wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attack | high | 7.5 | 9% |
| CVE-2022-0785 | daily-prayer-time (WordPress plugin) | The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement | critical | 9.8 | 9% |
| CVE-2011-4899 | WordPress core | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database ser | high | 7.5 | 9% |
| CVE-2016-10960 | wsecure (WordPress plugin) | The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter. | high | 8.8 | 9% |
| CVE-2008-4769 | WordPress core | Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, al | high | 9.3 | 9% |
| CVE-2021-44673 | croogo/croogo | Unrestricted Upload of File with Dangerous Type in Croogo | high | 8.8 | 9% |
| CVE-2016-15043 | wp-mobile-detector (WordPress plugin) | The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file i | critical | 9.8 | 9% |
| CVE-2021-24527 | profile-builder (WordPress plugin) | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of th | critical | 9.8 | 9% |
| CVE-2021-24666 | podlove-podcast-publisher (WordPress plugin) | The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds th | critical | 9.8 | 9% |
| CVE-2020-10257 | addons (WordPress plugin), aldo-gutenberg-wordpress-blog-theme (WordPress plugin), amuli (WordPress plugin) +60 more | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allow | critical | 9.8 | 9% |
| CVE-2018-19287 | ninja-forms (WordPress plugin) | XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss | medium | 6.1 | 9% |
| CVE-2014-4937 | bookx (WordPress plugin) | Directory traversal vulnerability in includes/bookx_export.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary file | medium | 5.0 | 9% |
| CVE-2022-1631 | microweber/microweber | Incorrect Authorization in microweber | high | 8.8 | 9% |
| CVE-2026-29058 | wwbn/avideo | WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php | critical | 9.8 | 9% |
| CVE-2022-0846 | speakout\!-email-petitions (WordPress plugin) | The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL state | critical | 9.8 | 9% |
| CVE-2022-1442 | metform (WordPress plugin) | The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php | high | 7.5 | 9% |
| CVE-2014-9094 | video-gallery (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for | medium | 4.3 | 9% |
| CVE-2019-11223 | supportcandy (WordPress plugin) | An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrar | critical | 9.8 | 9% |
| CVE-2013-3239 | phpmyadmin/phpmyadmin | phpMyAdmin Remote Code Execution | high | 8.5 | 9% |
| CVE-2021-24215 | controlled-admin-access (WordPress plugin) | An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to | critical | 9.8 | 9% |
| CVE-2022-1903 | armember (WordPress plugin) | The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization | high | 8.1 | 9% |
| CVE-2022-21705 | october/system | Authenticated remote code execution in October CMS | high | 7.2 | 9% |
| CVE-2016-1000112 | contus-video-comments (WordPress plugin) | Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin | critical | 9.1 | 9% |
| CVE-2020-9372 | appointment-booking-calendar (WordPress plugin) | The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking | high | 7.8 | 9% |
| CVE-2015-1000005 | candidate-application-form (WordPress plugin) | Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin | high | 7.5 | 9% |
| CVE-2012-2399 | WordPress core | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image | high | 10.0 | 9% |
| CVE-2019-15823 | wps-hide-login (WordPress plugin) | The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass. | critical | 9.8 | 9% |
| CVE-2020-10564 | wp-file-upload (WordPress plugin) | An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by up | critical | 9.8 | 9% |
| CVE-2020-13126 | elementor-page-builder (WordPress plugin) | An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE | critical | 9.9 | 9% |
| CVE-2020-9006 | popup-builder (WordPress plugin) | The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax | critical | 9.8 | 9% |
| CVE-2022-35649 | moodle/moodle | Moodle PostScript Code Injection | critical | 9.8 | 9% |
| CVE-2020-12478 | nilsteampassnet/teampass | TeamPass files are available without authentication | high | 7.5 | 9% |
| CVE-2023-6634 | learnpress (WordPress plugin) | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content fun | high | 8.1 | 9% |
| CVE-2010-3313 | egroupware/egroupware | EGroupware Code Injection vulnerability | high | 0.0 | 9% |
| CVE-2021-26119 | smarty/smarty | Sandbox escape through template_object in smarty | high | 7.5 | 8% |
| CVE-2023-1938 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using | high | 8.8 | 8% |
| CVE-2017-1000499 | phpmyadmin/phpmyadmin | phpMyAdmin CSRF Vulnerability | high | 8.8 | 8% |
| CVE-2015-8566 | joomla/session | Joomla! Framework Remote Code Injection Vulnerability | high | 0.0 | 8% |
| CVE-2026-26988 | librenms/librenms | LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream. | high | 0.0 | 8% |
| CVE-2009-3890 | WordPress core | Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a cert | medium | 6.0 | 8% |
| CVE-2021-24849 | frontend-manager-for-woocommerce-along-with-bookings-subscription-listings-compatible (WordPress plugin) | The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated | critical | 9.8 | 8% |
| CVE-2020-9664 | magento/core | Magento php object injection vulnerability | critical | 9.8 | 8% |
| CVE-2023-1545 | nilsteampassnet/teampass | Teampass SQL Injection vulnerability | high | 7.5 | 8% |
| CVE-2015-3313 | community-events (WordPress plugin) | SQL injection vulnerability in WordPress Community Events plugin before 1.4. | critical | 9.8 | 8% |
| CVE-2018-1000773 | WordPress core | WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code | high | 8.8 | 8% |
| CVE-2022-0769 | users-ultra (WordPress plugin) | The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolat | critical | 9.8 | 8% |
| CVE-2022-3766 | thorsten/phpmyfaq | phpMyFAQ vulnerable to reflected Cross-site Scripting | medium | 6.1 | 8% |