Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-6497 | magento/core | Magento arbitrary PHP code execution via the productData parameter | high | 8.8 | 7% |
| CVE-2020-9043 | wp-central (WordPress plugin) | The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key. | high | 8.8 | 7% |
| CVE-2014-8802 | pie-register (WordPress plugin) | The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows | medium | 5.0 | 7% |
| CVE-2021-24278 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retri | high | 7.5 | 7% |
| CVE-2016-4567 | WordPress core, contao-components/mediaelement, contao/core | Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, | medium | 6.1 | 7% |
| CVE-2015-5730 | WordPress core | The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time c | medium | 5.0 | 7% |
| CVE-2015-2807 | navis-documentcloud (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attacke | medium | 4.3 | 7% |
| CVE-2017-6104 | zen-mobile-app-native (WordPress plugin) | Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. | high | 7.5 | 7% |
| CVE-2007-3140 | WordPress core | SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a paramet | medium | 6.5 | 7% |
| CVE-2021-24943 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregiste | critical | 9.8 | 7% |
| CVE-2022-2941 | wp-useronline (WordPress plugin) | The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. Thi | medium | 5.5 | 7% |
| CVE-2021-24236 | imagements (WordPress plugin) | The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the requ | critical | 9.8 | 7% |
| CVE-2015-7669 | easy2map (WordPress plugin) | Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin befo | critical | 9.8 | 7% |
| CVE-2020-5766 | srs-simple-hits-counter (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 a | high | 7.5 | 7% |
| CVE-2024-51092 | librenms/librenms | LibreNMS has an Authenticated OS Command Injection | critical | 9.1 | 7% |
| CVE-2007-1897 | WordPress core | SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute ar | medium | 6.5 | 7% |
| CVE-2015-5533 | count-per-day (WordPress plugin) | SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated admini | high | 7.2 | 7% |
| CVE-2017-14722 | WordPress core | Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename. | high | 7.5 | 7% |
| CVE-2024-9989 | crypto (WordPress plugin) | The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbi | critical | 9.8 | 7% |
| CVE-2020-12832 | simple-file-list (WordPress plugin) | WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the applicatio | critical | 9.8 | 7% |
| CVE-2011-4624 | grand-flagallery (WordPress plugin) | Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allo | medium | 4.3 | 7% |
| CVE-2015-5732 | WordPress core | Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPres | medium | 4.3 | 7% |
| CVE-2021-36394 | moodle/moodle | Moodle Session Fixation vulnerability | critical | 9.8 | 7% |
| CVE-2015-2315 | wpml (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web scrip | medium | 4.3 | 7% |
| CVE-2017-17091 | WordPress core | wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which al | high | 8.8 | 7% |
| CVE-2017-5594 | pagekit/pagekit | Pagekit Weak Password Recovery Mechanism for Forgotten Password | high | 7.5 | 7% |
| CVE-2007-5710 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web scr | low | 2.6 | 7% |
| CVE-2013-1463 | wp-table-reloaded (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allow | medium | 4.3 | 7% |
| CVE-2023-3452 | canto (WordPress plugin) | The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter | critical | 9.8 | 7% |
| CVE-2023-2636 | an-gradebook (WordPress plugin) | The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leadin | high | 8.8 | 7% |
| CVE-2015-5714 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leverag | medium | 6.1 | 7% |
| CVE-2022-0660 | microweber/microweber | Generation of Error Message Containing Sensitive Information in microweber | high | 7.5 | 7% |
| CVE-2022-1453 | rsvpmaker (WordPress plugin) | The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user s | critical | 9.8 | 7% |
| CVE-2022-0693 | master-elements (WordPress plugin) | The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX | critical | 9.8 | 7% |
| CVE-2020-36705 | adning-advertising (WordPress plugin) | The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_ | critical | 9.8 | 7% |
| CVE-2014-8604 | xcloner (WordPress plugin) | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration pane | medium | 5.0 | 7% |
| CVE-2014-8605 | xcloner (WordPress plugin) | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with ins | medium | 5.0 | 7% |
| CVE-2006-6808 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script | medium | 6.8 | 7% |
| CVE-2015-2314 | wpml (WordPress plugin) | SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the | high | 7.5 | 7% |
| CVE-2015-1000010 | simple-image-manipulator (WordPress plugin) | Remote file download in simple-image-manipulator v1.0 wordpress plugin | high | 7.5 | 7% |
| CVE-2021-4073 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if t | critical | 9.8 | 7% |
| CVE-2023-30943 | moodle/moodle | Moodle External Control of File Name or Path vulnerability | medium | 5.3 | 7% |
| CVE-2014-1908 | videowhisper-live-streaming-integration (WordPress plugin) | The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integra | medium | 5.0 | 7% |
| CVE-2021-25079 | contact-form-entries (WordPress plugin) | The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, o | medium | 6.1 | 7% |
| CVE-2023-2437 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient | critical | 9.8 | 7% |
| CVE-2022-31181 | prestashop/prestashop | PrestaShop eval injection possible if shop vulnerable to SQL injection | critical | 9.8 | 7% |
| CVE-2017-16510 | WordPress core | WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL inje | critical | 9.8 | 7% |
| CVE-2021-25032 | capabilities (WordPress plugin) | The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have autho | critical | 9.8 | 7% |
| CVE-2016-15042 | frontend-file-manager (WordPress plugin), post-front-end-form (WordPress plugin) | The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary f | critical | 9.8 | 7% |
| CVE-2021-4436 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_ | critical | 9.8 | 7% |