Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-35136 | dolibarr/dolibarr | Dolibarr authenticated Remote Code Execution | high | 7.2 | 7% |
| CVE-2021-24554 | paytm-pay (WordPress plugin) | The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a S | high | 7.2 | 7% |
| CVE-2022-3254 | awp-classifieds (WordPress plugin) | The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQ | critical | 9.8 | 7% |
| CVE-2022-4047 | return-refund-and-exchange-for-woocommerce (WordPress plugin) | The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX a | critical | 9.8 | 7% |
| CVE-2014-8770 | dweeves/magmi | MAGMI plugin for Magento Unsafe File Upload | high | 0.0 | 7% |
| CVE-2015-5734 | WordPress core | Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allow | medium | 4.3 | 7% |
| CVE-2021-36888 | image-hover-effects-ultimate (WordPress plugin) | Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versio | critical | 9.8 | 7% |
| CVE-2014-9444 | frontend-uploader (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web | medium | 4.3 | 7% |
| CVE-2017-14723 | WordPress core | Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly addre | critical | 9.8 | 7% |
| CVE-2012-6653 | all-video-gallery (WordPress plugin) | Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack v | high | 7.5 | 6% |
| CVE-2021-24627 | g-auto-hyperlink (WordPress plugin) | The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to | high | 7.2 | 6% |
| CVE-2019-15896 | lifterlms (WordPress plugin) | An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php | critical | 9.8 | 6% |
| CVE-2007-1049 | WordPress core | Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for Wor | medium | 4.3 | 6% |
| CVE-2004-1559 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the ( | medium | 4.3 | 6% |
| CVE-2023-32073 | wwbn/avideo | WWBN AVideo command injection vulnerability | high | 8.8 | 6% |
| CVE-2021-24316 | mediumish (WordPress plugin) | The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back t | medium | 6.1 | 6% |
| CVE-2023-6971 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP heade | high | 8.1 | 6% |
| CVE-2021-24731 | pie-register (WordPress plugin) | The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7. | critical | 9.8 | 6% |
| CVE-2015-5715 | WordPress core | The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authentic | medium | 4.3 | 6% |
| CVE-2015-1494 | fancybox-for-wordpress (WordPress plugin) | The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cro | medium | 4.3 | 6% |
| CVE-2014-2921 | pimcore/pimcore | Pimcore Vulnerable to PHP Object Injection Attacks | high | 0.0 | 6% |
| CVE-2015-3300 | thecartpress (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Pl | medium | 4.3 | 6% |
| CVE-2022-24977 | impresscms/impresscms | Path Traversal in ImpressCMS | critical | 9.8 | 6% |
| CVE-2020-24912 | qcubed/qcubed | qcubed reflected cross-site scripting (XSS) vulnerability | medium | 6.1 | 6% |
| CVE-2021-24237 | findeo (WordPress plugin), realteo (WordPress plugin) | The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms | medium | 6.1 | 6% |
| CVE-2009-2334 | WordPress core | wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of | medium | 4.9 | 6% |
| CVE-2015-5461 | stageshow (WordPress plugin) | Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows rem | medium | 6.4 | 6% |
| CVE-2023-4278 | masterstudy-lms (WordPress plugin) | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone | high | 7.5 | 6% |
| CVE-2025-6058 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() f | critical | 9.8 | 6% |
| CVE-2015-2824 | simple-ads-manager (WordPress plugin) | Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitr | high | 7.5 | 6% |
| CVE-2019-10866 | form-maker (WordPress plugin) | In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the fi | critical | 9.8 | 6% |
| CVE-2014-8603 | xcloner (WordPress plugin) | cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code | medium | 6.5 | 6% |
| CVE-2015-5243 | brightlocal/phpwhois, david-garcia/phpwhois, ivankristianto/phpwhois +7 more | phpWhois arbitrary code execution via a crafted whois record | critical | 9.8 | 6% |
| CVE-2019-14537 | yourls/yourls | Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls | critical | 9.8 | 6% |
| CVE-2015-1366 | pixabay-images (WordPress plugin) | Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers | medium | 4.3 | 6% |
| CVE-2014-5345 | disqus-comment-system (WordPress plugin) | Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attacker | medium | 4.3 | 6% |
| CVE-2015-4063 | newstatpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote auth | low | 3.5 | 6% |
| CVE-2018-10371 | wf-cookie-consent (WordPress plugin) | An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has | medium | 6.1 | 6% |
| CVE-2014-4172 | jasig/phpcas | Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability | critical | 9.8 | 6% |
| CVE-2014-8606 | xcloner (WordPress plugin) | Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbit | medium | 4.0 | 6% |
| CVE-2025-3515 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient f | high | 8.1 | 6% |
| CVE-2019-10910 | symfony/dependency-injection, symfony/proxy-manager-bridge, symfony/symfony | Symfony Service IDs Allow Injection | critical | 9.8 | 6% |
| CVE-2020-9691 | magento/community-edition, magento/project-community-edition | Magento DOM-based Cross-site scripting vulnerability | critical | 9.6 | 6% |
| CVE-2022-2383 | feed-them-social (WordPress plugin) | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 6% |
| CVE-2016-4566 | WordPress core | Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote at | medium | 6.1 | 6% |
| CVE-2023-2779 | social-share\,-social-login-and-social-comments (WordPress plugin) | The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputtin | medium | 6.1 | 6% |
| CVE-2022-41343 | dompdf/dompdf | Dompdf allows remote file inclusion because URI validation failure does not halt font registration | high | 7.5 | 6% |
| CVE-2014-3849 | imember360 (WordPress plugin) | The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbit | medium | 4.3 | 6% |
| CVE-2015-7806 | form-manager (WordPress plugin) | Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allo | critical | 9.8 | 6% |
| CVE-2007-1622 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows | medium | 4.3 | 6% |