Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6825 | wp-file-manager (WordPress plugin) | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7 | critical | 9.9 | 6% |
| CVE-2024-4474 | wp-logs-book (WordPress plugin) | The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 6% |
| CVE-2019-7441 | paypal-checkout-payment-gateway (WordPress plugin) | cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amou | medium | 6.5 | 6% |
| CVE-2021-24227 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by | high | 7.5 | 6% |
| CVE-2020-15363 | nexos (WordPress theme) | The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection. | critical | 9.8 | 6% |
| CVE-2021-37704 | phpfastcache/phpfastcache | Exposed phpinfo() leadked via documentation files | medium | 5.4 | 6% |
| CVE-2021-24644 | images-to-webp (WordPress plugin) | The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, | high | 7.5 | 6% |
| CVE-2026-44262 | dedoc/scramble | Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules | critical | 9.4 | 6% |
| CVE-2025-8100 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' p | medium | 5.4 | 6% |
| CVE-2009-3622 | WordPress core | Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU | medium | 4.3 | 6% |
| CVE-2024-28116 | getgrav/grav | Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass | high | 8.8 | 6% |
| CVE-2022-1950 | youzify (WordPress plugin) | The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action ava | critical | 9.8 | 6% |
| CVE-2018-20151 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual config | high | 7.5 | 6% |
| CVE-2019-7850 | magento/product-community-edition | PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature | unknown | 0.0 | 6% |
| CVE-2024-2667 | instawp-connect (WordPress plugin) | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file | critical | 9.8 | 6% |
| CVE-2022-41840 | welcart-e-commerce (WordPress plugin) | Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress. | high | 7.5 | 6% |
| CVE-2019-19134 | hero-maps-premium (WordPress plugin) | The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter bec | medium | 6.1 | 6% |
| CVE-2022-0448 | cp-blocks (WordPress plugin) | The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users | medium | 4.8 | 6% |
| CVE-2021-24245 | stop-spammers (WordPress plugin) | The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting | medium | 6.1 | 6% |
| CVE-2020-9576 | magento/community-edition, magento/core, magento/project-community-edition | Magento command injection vulnerability | critical | 9.8 | 6% |
| CVE-2020-9578 | magento/community-edition, magento/core, magento/project-community-edition | Magento command injection vulnerability | critical | 9.8 | 6% |
| CVE-2020-9582 | magento/community-edition, magento/core, magento/project-community-edition | Magento command injection vulnerability | critical | 9.8 | 6% |
| CVE-2020-9583 | magento/community-edition, magento/core, magento/project-community-edition | Magento command injection vulnerability | critical | 9.8 | 6% |
| CVE-2020-26596 | elementor-pro (WordPress plugin) | The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code | high | 8.8 | 6% |
| CVE-2019-16332 | api-bearer-auth (WordPress plugin) | In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php f | medium | 6.1 | 6% |
| CVE-2017-6095 | mail-masta (WordPress plugin) | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Una | critical | 9.8 | 6% |
| CVE-2014-3961 | participants-database (WordPress plugin) | SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers | high | 7.5 | 6% |
| CVE-2021-25118 | yoast-seo (WordPress plugin) | The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/po | medium | 5.3 | 6% |
| CVE-2021-26600 | impresscms/impresscms | Type Confusion in ImpressCMS | critical | 9.8 | 6% |
| CVE-2021-21030 | magento/community-edition, magento/project-community-edition | Magento stored cross-site scripting (XSS) in the customer address upload feature | high | 8.1 | 6% |
| CVE-2015-2292 | wordpress-seo (WordPress plugin) | Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x be | medium | 6.5 | 6% |
| CVE-2021-24741 | support-board---chat-and-help-desk (WordPress plugin) | The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversa | critical | 9.8 | 6% |
| CVE-2016-10940 | zm-gallery (WordPress plugin) | The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter. | high | 7.2 | 6% |
| CVE-2025-31131 | yeswiki/yeswiki | Yeswiki Path Traversal vulnerability allows arbitrary read of files | high | 8.6 | 6% |
| CVE-2024-3673 | web-directory-free (WordPress plugin) | The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Loca | critical | 9.1 | 6% |
| CVE-2021-24170 | user-profile-picture (WordPress plugin) | The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for it | high | 7.5 | 6% |
| CVE-2006-3360 | phpsysinfo/phpsysinfo | phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence | medium | 0.0 | 6% |
| CVE-2020-29304 | directories-pro (WordPress plugin) | A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows atta | medium | 6.1 | 6% |
| CVE-2008-0491 | fgallery (WordPress plugin) | SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL comma | high | 7.5 | 6% |
| CVE-2021-24139 | photo-gallery (WordPress plugin) | Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the fronte | critical | 9.8 | 6% |
| CVE-2020-12077 | mappress-google-maps-for-wordpress (WordPress plugin) | The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capabi | high | 8.8 | 6% |
| CVE-2022-1339 | pimcore/pimcore | SQL Injection in Pimcore | high | 7.5 | 6% |
| CVE-2016-1000217 | zotpress (WordPress plugin) | Zotpress plugin for WordPress SQLi in zp_get_account() | critical | 9.8 | 6% |
| CVE-2019-16525 | checklist (WordPress plugin) | An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklis | medium | 6.1 | 6% |
| CVE-2023-3077 | mstore-api (WordPress plugin) | The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind | critical | 9.8 | 6% |
| CVE-2021-24299 | redi-restaurant-reservation (WordPress plugin) | The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These | medium | 6.1 | 6% |
| CVE-2008-4106 | WordPress core | WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of t | medium | 5.1 | 5% |
| CVE-2019-11831 | drupal/core, drupal/drupal, typo3/phar-stream-wrapper | This security release fixes third-party dependencies included in or required by Drupal core. As described in [TYPO3-PSA- | critical | 9.8 | 5% |
| CVE-2021-24610 | translatepress (WordPress plugin) | The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_strin | medium | 4.8 | 5% |
| CVE-2026-61450 | getgrav/grav | Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) | medium | 6.5 | 5% |