Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-5730 | WordPress core | The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time c | medium | 5.0 | 7% |
| CVE-2022-0660 | microweber/microweber | Generation of Error Message Containing Sensitive Information in microweber | high | 7.5 | 7% |
| CVE-2014-8604 | xcloner (WordPress plugin) | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration pane | medium | 5.0 | 7% |
| CVE-2014-1908 | videowhisper-live-streaming-integration (WordPress plugin) | The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integra | medium | 5.0 | 7% |
| CVE-2014-8603 | xcloner (WordPress plugin) | cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code | medium | 6.5 | 6% |
| CVE-2021-24227 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by | high | 7.5 | 6% |
| CVE-2021-37704 | phpfastcache/phpfastcache | Exposed phpinfo() leadked via documentation files | medium | 5.4 | 6% |
| CVE-2018-20151 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual config | high | 7.5 | 6% |
| CVE-2021-25118 | yoast-seo (WordPress plugin) | The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/po | medium | 5.3 | 6% |
| CVE-2021-24170 | user-profile-picture (WordPress plugin) | The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for it | high | 7.5 | 6% |
| CVE-2008-4106 | WordPress core | WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of t | medium | 5.1 | 5% |
| CVE-2026-61450 | getgrav/grav | Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) | medium | 6.5 | 5% |
| CVE-2021-24226 | accessally (WordPress plugin) | In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_ | high | 7.5 | 5% |
| CVE-2024-1208 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. | medium | 5.3 | 5% |
| CVE-2015-7527 | cool-video-gallery (WordPress plugin) | lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters i | high | 7.5 | 5% |
| CVE-2017-5610 | WordPress core | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assign | medium | 5.3 | 5% |
| CVE-2016-4793 | cakephp/cakephp | CakePHP allows remote attackers to spoof their IP | high | 7.5 | 5% |
| CVE-2018-19487 | wp-jobhunt (WordPress plugin) | The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function throug | high | 7.5 | 5% |
| CVE-2014-4942 | wp-easycart (WordPress plugin) | The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct reques | medium | 5.0 | 5% |
| CVE-2019-20041 | WordPress core | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass | critical | 9.8 | 5% |
| CVE-2023-34448 | getgrav/grav | Grav Server-side Template Injection (SSTI) via Twig Default Filters | high | 7.2 | 5% |
| CVE-2008-2392 | WordPress core | Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute | high | 9.0 | 4% |
| CVE-2017-9065 | WordPress core | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. | high | 7.5 | 4% |
| CVE-2011-4962 | silverstripe/cms | Silverstripe CMS Arbitrary Code Execution | medium | 0.0 | 4% |
| CVE-2019-11832 | typo3/cms, typo3/cms-core | TYPO3 Image Processing susceptible to Code Execution | high | 7.5 | 4% |
| CVE-2014-9038 | WordPress core | wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cond | medium | 6.4 | 4% |
| CVE-2017-1000600 | WordPress core | WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. Th | high | 8.8 | 4% |
| CVE-2016-5835 | WordPress core | WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, re | high | 7.5 | 4% |
| CVE-2022-2462 | transposh-translation-filter-for-wordpress (WordPress plugin) | The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versi | medium | 5.3 | 4% |
| CVE-2019-15324 | ad-inserter (WordPress plugin) | The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. | high | 8.8 | 4% |
| CVE-2018-20152 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. | medium | 6.5 | 4% |
| CVE-2020-15086 | friendsoftypo3/mediace | Potential Remote Code Execution in TYPO3 with mediace extension | critical | 9.8 | 4% |
| CVE-2015-3634 | slideshow-jquery-image-gallery (WordPress plugin) | The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remo | high | 7.5 | 3% |
| CVE-2020-9591 | magento/community-edition, magento/core | Magento defense-in-depth security mitigation vulnerability | high | 7.5 | 3% |
| CVE-2015-9415 | bj-lazy-load (WordPress plugin) | The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion. | high | 7.5 | 3% |
| CVE-2008-0195 | WordPress core | WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP | medium | 5.0 | 3% |
| CVE-2009-0258 | typo3/cms | Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection | high | 0.0 | 3% |
| CVE-2012-6512 | organizer (WordPress plugin) | The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to (1) plugin_hook. | medium | 5.0 | 3% |
| CVE-2018-6015 | email-subscribers (WordPress plugin) | An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI wi | high | 7.5 | 3% |
| CVE-2015-9269 | wordpress-mobile-pack (WordPress plugin) | The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attacke | high | 7.5 | 3% |
| CVE-2011-0701 | WordPress core | wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) p | medium | 4.0 | 3% |
| CVE-2011-4957 | WordPress core | The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the | medium | 5.0 | 3% |
| CVE-2012-1607 | typo3/cms | TYPO3 allows remote attackers to obtain the database name via a direct request | medium | 0.0 | 3% |
| CVE-2010-5099 | typo3/cms | TYPO3 Path Traversal vulnerability | medium | 0.0 | 3% |
| CVE-2015-9481 | diplomat-\|-political (WordPress theme) | The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as | high | 7.5 | 3% |
| CVE-2015-9482 | car-dealer-\/-auto-dealer-responsive (WordPress theme) | The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive infor | high | 7.5 | 3% |
| CVE-2015-9483 | invento-\/-architecture-building-agency-template (WordPress plugin) | The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtai | high | 7.5 | 3% |
| CVE-2015-9484 | accio-one-page-parallax-responsive-theme (WordPress theme) | The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive inform | high | 7.5 | 3% |
| CVE-2015-9485 | accio-responsive-onepage-parallax-site-template (WordPress plugin) | The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtai | high | 7.5 | 3% |
| CVE-2015-9486 | axioma-premium-responsive (WordPress theme) | The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (su | high | 7.5 | 3% |