Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-7391 | dweeves/magmi | Magmi XSS Vulnerability | medium | 6.1 | 8% |
| CVE-2015-1561 | centreon/centreon | Centreon Command Injection | high | 8.5 | 8% |
| CVE-2022-3124 | frontend-file-manager (WordPress plugin) | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermo | medium | 5.3 | 8% |
| CVE-2015-4038 | wpmembership (WordPress plugin) | The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_ | medium | 6.5 | 8% |
| CVE-2021-24579 | bold-page-builder (WordPress plugin) | The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function with | high | 8.8 | 8% |
| CVE-2015-4050 | symfony/http-kernel, symfony/symfony | Symfony Incorrect Access Control | medium | 0.0 | 8% |
| CVE-2022-23614 | twig/twig | Code injection in Twig | high | 8.8 | 8% |
| CVE-2021-24160 | responsive-menu (WordPress plugin) | In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files th | high | 8.8 | 8% |
| CVE-2021-39165 | cachethq/cachet | Unauthenticated SQL Injection in Cachet | high | 8.1 | 8% |
| CVE-2022-0422 | white-label-cms (WordPress plugin) | The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it | medium | 6.1 | 8% |
| CVE-2020-28037 | WordPress core | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which | critical | 9.8 | 8% |
| CVE-2019-10869 | ninja-forms-file-uploads (WordPress plugin) | Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activat | high | 8.1 | 8% |
| CVE-2021-34624 | profilepress (WordPress plugin) | A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it | critical | 9.8 | 8% |
| CVE-2022-1057 | pricing-deals-for-woocommerce (WordPress plugin) | The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a S | critical | 9.8 | 8% |
| CVE-2020-36849 | csv-import-\/-export (WordPress plugin) | The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-conten | critical | 9.8 | 8% |
| CVE-2022-0814 | ubigeo-de-peru-para-woocommerce (WordPress plugin) | The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in | critical | 9.8 | 8% |
| CVE-2022-23808 | phpmyadmin/phpmyadmin | Cross-site Scripting in phpmyadmin | medium | 6.1 | 8% |
| CVE-2021-24212 | help-scout (WordPress plugin) | The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated u | critical | 9.8 | 8% |
| CVE-2009-2851 | WordPress core | Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrar | medium | 4.3 | 8% |
| CVE-2016-2222 | WordPress core | The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request f | high | 8.6 | 8% |
| CVE-2013-4339 | WordPress core | WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redi | high | 7.5 | 8% |
| CVE-2023-4827 | filester (WordPress plugin) | The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attac | high | 8.8 | 8% |
| CVE-2023-5204 | chatbot (WordPress plugin) | The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insu | critical | 9.8 | 8% |
| CVE-2018-19277 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet due to encoding issue | high | 8.8 | 8% |
| CVE-2022-0788 | fundengine (WordPress plugin) | The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it | critical | 9.8 | 8% |
| CVE-2015-5623 | WordPress core | WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access | medium | 4.0 | 8% |
| CVE-2015-20067 | wp-attachment-export (WordPress plugin) | The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the | high | 7.5 | 8% |
| CVE-2006-5031 | cakephp/cakephp | CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files | medium | 0.0 | 8% |
| CVE-2018-20985 | wp-payeezy-pay (WordPress plugin) | The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec. | critical | 9.8 | 8% |
| CVE-2022-0949 | block-and-stop-bad-bots (WordPress plugin) | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise | critical | 9.8 | 8% |
| CVE-2007-0540 | WordPress core | WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source UR | medium | 5.0 | 8% |
| CVE-2012-0937 | WordPress core | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to ex | medium | 5.0 | 8% |
| CVE-2026-48030 | pheditor/pheditor | Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter | critical | 9.9 | 8% |
| CVE-2017-11366 | codiad/codiad | Codiad Vulnerable to Shell Command Injection | critical | 9.8 | 8% |
| CVE-2007-1244 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileg | medium | 6.8 | 8% |
| CVE-2022-0993 | siteground-security (WordPress plugin) | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administr | high | 8.1 | 8% |
| CVE-2026-6204 | librenms/librenms | LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write | high | 0.0 | 8% |
| CVE-2023-3219 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid E | medium | 5.3 | 8% |
| CVE-2022-0658 | commonsbooking (WordPress plugin) | The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (avail | critical | 9.8 | 8% |
| CVE-2022-0787 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL | critical | 9.8 | 8% |
| CVE-2020-3718 | magento/community-edition, magneto/core | Magento security bypass vulnerability | critical | 9.8 | 8% |
| CVE-2014-8949 | imember360 (WordPress plugin) | The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via she | medium | 6.0 | 8% |
| CVE-2022-1013 | personal-dictionary (WordPress plugin) | The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in | critical | 9.8 | 7% |
| CVE-2014-9262 | duplicator (WordPress plugin) | The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files. | high | 8.2 | 7% |
| CVE-2015-4127 | church-admin (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary w | medium | 4.3 | 7% |
| CVE-2022-0864 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before ou | medium | 6.1 | 7% |
| CVE-2020-9631 | magento/community-edition, magento/core, magento/project-community-edition | Magento security mitigation bypass vulnerability | critical | 9.8 | 7% |
| CVE-2020-9632 | magento/community-edition, magento/core, magento/project-community-edition | Magento security mitigation bypass vulnerability | critical | 9.8 | 7% |
| CVE-2015-3438 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attacker | medium | 4.3 | 7% |
| CVE-2020-5295 | october/cms | Local File read vulnerability in OctoberCMS | medium | 4.8 | 7% |