Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9483 | invento-\/-architecture-building-agency-template (WordPress plugin) | The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtai | high | 7.5 | 3% |
| CVE-2015-9484 | accio-one-page-parallax-responsive-theme (WordPress theme) | The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive inform | high | 7.5 | 3% |
| CVE-2015-9485 | accio-responsive-onepage-parallax-site-template (WordPress plugin) | The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtai | high | 7.5 | 3% |
| CVE-2015-9486 | axioma-premium-responsive (WordPress theme) | The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (su | high | 7.5 | 3% |
| CVE-2015-9487 | almera-responsive-portfolio (WordPress theme) | The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information ( | high | 7.5 | 3% |
| CVE-2015-9488 | almera-responsive-portfolio-site-template (WordPress plugin) | The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensi | high | 7.5 | 3% |
| CVE-2015-9489 | goodnex-premium-responsive (WordPress theme) | The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s | high | 7.5 | 3% |
| CVE-2015-9490 | gamestheme-premium (WordPress theme) | The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as u | high | 7.5 | 3% |
| CVE-2015-9491 | blessing-premium-responsive (WordPress theme) | The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information ( | high | 7.5 | 3% |
| CVE-2015-9492 | smartit-premium-responsive (WordPress theme) | The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s | high | 7.5 | 3% |
| CVE-2017-6514 | WordPress core | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a / | medium | 5.3 | 3% |
| CVE-2015-0902 | all-in-one-seo-pack (WordPress plugin) | The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation | medium | 5.0 | 3% |
| CVE-2016-5739 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-Site Request Forgery | high | 7.5 | 3% |
| CVE-2022-1595 | hc-custom-wp-admin-url (WordPress plugin) | The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request | medium | 5.3 | 3% |
| CVE-2018-19968 | phpmyadmin/phpmyadmin | phpMyAdmin Local file inclusion through transformation feature | medium | 6.5 | 3% |
| CVE-2012-5868 | WordPress core | WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote a | low | 2.6 | 3% |
| CVE-2016-5730 | phpmyadmin/phpmyadmin | phpMyAdmin full path disclosure vulnerability | medium | 5.3 | 3% |
| CVE-2008-0191 | WordPress core | WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the defaul | medium | 5.0 | 3% |
| CVE-2014-9177 | html5-mp3-player-with-playlist (WordPress plugin) | The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a reques | medium | 5.0 | 3% |
| CVE-2016-9853 | phpmyadmin/phpmyadmin | phpMyAdmin path disclosure | medium | 5.3 | 3% |
| CVE-2011-3818 | WordPress core | WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the ins | medium | 5.0 | 3% |
| CVE-2011-3128 | WordPress core | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain se | medium | 5.0 | 2% |
| CVE-2014-10076 | wp-db-backup (WordPress plugin) | The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers | high | 7.5 | 2% |
| CVE-2024-1209 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via dire | medium | 5.3 | 2% |
| CVE-2018-1999009 | october/october | October CMS Local File Inclusion | high | 8.1 | 2% |
| CVE-2015-5267 | moodle/moodle | Moodle uses predictable password-recovery tokens | high | 7.5 | 2% |
| CVE-2024-12008 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the public | medium | 5.3 | 2% |
| CVE-2013-2202 | WordPress core | WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity dec | medium | 4.3 | 2% |
| CVE-2020-15098 | typo3/cms, typo3/cms-core | Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS | high | 8.8 | 2% |
| CVE-2016-6212 | drupal/core, drupal/drupal | Drupal Views can allow unauthorized users to see Statistics information | medium | 5.3 | 2% |
| CVE-2011-3126 | WordPress core | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects. | medium | 5.0 | 2% |
| CVE-2023-49282 | microsoft/microsoft-graph | Test code in published microsoft-graph package exposes phpinfo() | medium | 5.4 | 2% |
| CVE-2023-49283 | microsoft/microsoft-graph-core | Test code in published microsoft-graph-core package exposes phpinfo() | medium | 5.4 | 2% |
| CVE-2014-100009 | js-multi-hotel (WordPress plugin) | The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtai | medium | 5.0 | 2% |
| CVE-2017-5223 | phpmailer/phpmailer | Local file disclosure in PHPMailer | medium | 5.5 | 2% |
| CVE-2015-1000008 | mp3-jplayer (WordPress plugin) | Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 | medium | 5.3 | 2% |
| CVE-2011-4283 | moodle/moodle | Moodle allows remote attackers to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2011-4284 | moodle/moodle | Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context page | medium | 0.0 | 2% |
| CVE-2014-7848 | moodle/moodle | Moodle allows attacks to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2017-17898 | dolibarr/dolibarr | Dolibarr sensitive information disclosure | high | 7.5 | 2% |
| CVE-2021-29450 | WordPress core | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts a | medium | 6.5 | 2% |
| CVE-2016-3170 | drupal/core, drupal/drupal | Drupal sensitive information disclosure | medium | 5.3 | 2% |
| CVE-2020-24406 | magento/community-edition | Magento information disclosure vulnerability | low | 3.7 | 2% |
| CVE-2018-19456 | wpbackupplus (WordPress plugin) | The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from serve | high | 7.5 | 2% |
| CVE-2023-6266 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the B | high | 7.5 | 2% |
| CVE-2018-10890 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 2% |
| CVE-2019-12474 | mediawiki/core | Wikimedia information leak vulnerability | high | 7.5 | 2% |
| CVE-2024-1210 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. | medium | 5.3 | 2% |
| CVE-2022-31042 | guzzlehttp/guzzle, drupal/core | Failure to strip the Cookie header on change in host or HTTP downgrade | high | 7.5 | 2% |
| CVE-2020-12070 | advanced-woo-search (WordPress plugin) | The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every aja | high | 7.5 | 2% |