Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4067 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 5.4 | 94% |
| CVE-2022-4069 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 4.8 | 93% |
| CVE-2024-9047 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_do | critical | 9.8 | 93% |
| CVE-2023-0992 | wp-simple-firewall (WordPress plugin) | The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'Use | high | 7.2 | 93% |
| CVE-2022-1329 | elementor (WordPress plugin) | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capabili | high | 8.8 | 93% |
| CVE-2023-23488 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' para | critical | 9.8 | 92% |
| CVE-2019-8943 | WordPress core | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output ima | medium | 6.5 | 92% |
| CVE-2014-8739 | sexy-contact-form (WordPress plugin), blueimp/jquery-file-upload | Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Cre | critical | 9.8 | 92% |
| CVE-2018-3810 | smart-google-code-inserter (WordPress plugin) | Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attacker | critical | 9.8 | 91% |
| CVE-2017-7615 | mantisbt/mantisbt | MantisBT allows arbitrary password reset | high | 8.8 | 91% |
| CVE-2023-6875 | post-smtp (WordPress plugin) | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unau | critical | 9.8 | 90% |
| CVE-2024-1071 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | critical | 9.8 | 89% |
| CVE-2022-1707 | google-tag-manager (WordPress plugin) | The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the sit | medium | 6.1 | 89% |
| CVE-2018-19207 | wp-gdpr-compliance (WordPress plugin) | The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code | critical | 9.8 | 88% |
| CVE-2020-8772 | infinitewp-client (WordPress plugin) | The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker | critical | 9.8 | 88% |
| CVE-2024-43425 | moodle/moodle | Moodle Remote Code Execution vulnerability | high | 8.1 | 88% |
| CVE-2023-28121 | woocommerce-payments (WordPress plugin), woopayments (WordPress plugin) | An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on beha | critical | 9.8 | 87% |
| CVE-2017-5487 | WordPress core | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not prop | medium | 5.3 | 87% |
| CVE-2021-24145 | modern-events-calendar-lite (WordPress plugin) | Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, | high | 7.2 | 87% |
| CVE-2019-11358 | maximebf/debugbar, drupal/core | XSS in jQuery as used in Drupal, Backdrop CMS, and other products | medium | 6.1 | 87% |
| CVE-2021-24762 | perfect-survey (WordPress plugin) | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL stateme | critical | 9.8 | 87% |
| CVE-2018-10095 | dolibarr/dolibarr | Dolibarr Cross-site scripting (XSS) vulnerability | medium | 6.1 | 87% |
| CVE-2023-5360 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthe | critical | 9.8 | 86% |
| CVE-2021-29447 | WordPress core | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Libr | high | 7.1 | 86% |
| CVE-2023-4634 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and incl | critical | 9.8 | 86% |
| CVE-2022-0441 | masterstudy-lms (WordPress plugin) | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenti | critical | 9.8 | 85% |
| CVE-2019-20361 | email-subscribers-\&-newsletters (WordPress plugin) | There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the data | critical | 9.8 | 85% |
| CVE-2009-2335 | WordPress core | WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, | medium | 5.0 | 85% |
| CVE-2017-1001000 | WordPress core | The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before | high | 7.5 | 85% |
| CVE-2021-21029 | magento/community-edition | Magento Reflected Cross-site Scripting vulnerability via 'file' parameter | medium | 4.8 | 85% |
| CVE-2023-3388 | beautiful-and-responsive-cookie-consent (WordPress plugin) | The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in v | high | 7.2 | 84% |
| CVE-2021-25080 | contact-form-entries (WordPress plugin) | The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as C | medium | 6.1 | 84% |
| CVE-2021-24155 | backup-guard (WordPress plugin) | The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP | high | 7.2 | 84% |
| CVE-2022-28368 | dompdf/dompdf | Remote code injection in dompdf/dompdf | critical | 9.8 | 84% |
| CVE-2021-23174 | download-monitor (WordPress plugin) | Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4. | low | 3.4 | 84% |
| CVE-2022-2753 | ketchup-restaurant-reservations (WordPress plugin) | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowin | medium | 6.1 | 84% |
| CVE-2024-2653 | amphp/http, amphp/http-client | AMPHP Denial of Service via HTTP/2 CONTINUATION Frames | high | 8.2 | 83% |
| CVE-2014-9034 | WordPress core | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers | medium | 5.0 | 83% |
| CVE-2021-25094 | tatsu (WordPress plugin) | The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is | high | 8.1 | 83% |
| CVE-2024-10400 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2. | high | 7.5 | 83% |
| CVE-2019-14470 | cosenary/instagram, user-pro (WordPress plugin) | Cosenary Instagram-PHP-API contains reflected XSS vulnerability | medium | 6.1 | 83% |
| CVE-2019-8942 | WordPress core | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an a | high | 8.8 | 83% |
| CVE-2021-26120 | smarty/smarty | PHP Code Injection by malicious function name in smarty | critical | 9.8 | 82% |
| CVE-2024-10924 | really-simple-ssl (WordPress plugin) | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to | critical | 9.8 | 82% |
| CVE-2023-30253 | dolibarr/dolibarr | Dolibarr vulnerable to remote code execution via uppercase manipulation | high | 8.8 | 82% |
| CVE-2021-25114 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthentica | critical | 9.8 | 82% |
| CVE-2016-5734 | phpmyadmin/phpmyadmin | phpMyAdmin Code Injection vulnerability | critical | 9.8 | 81% |
| CVE-2022-25148 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id p | critical | 9.8 | 81% |
| CVE-2024-4990 | yiisoft/yii2 | Unsafe Reflection in base Component class in yiisoft/yii2 | high | 8.1 | 80% |
| CVE-2021-42362 | wordpress-popular-posts (WordPress plugin) | The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in | high | 8.8 | 80% |