Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-10137 | website-contact-form-with-file-upload (WordPress plugin) | The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation i | critical | 9.8 | 5% |
| CVE-2013-1852 | leaguemanager (WordPress plugin) | SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute a | high | 7.5 | 5% |
| CVE-2020-13252 | centreon/centreon | Command Injection in Centreon | high | 8.8 | 5% |
| CVE-2009-2336 | WordPress core | The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whet | medium | 5.0 | 5% |
| CVE-2021-24226 | accessally (WordPress plugin) | In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_ | high | 7.5 | 5% |
| CVE-2021-4449 | zoomsounds (WordPress plugin) | The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in | critical | 9.8 | 5% |
| CVE-2022-1598 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allo | medium | 5.3 | 5% |
| CVE-2015-4704 | download-zip-attachments (WordPress plugin) | Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files v | high | 7.5 | 5% |
| CVE-2018-8729 | aryo-activity-log (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject a | medium | 6.1 | 5% |
| CVE-2022-4117 | iws-geo-form-fields (WordPress plugin) | The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to | critical | 9.8 | 5% |
| CVE-2019-16118 | photo-gallery (WordPress plugin) | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Option | medium | 6.1 | 5% |
| CVE-2017-14507 | content-timeline (WordPress plugin) | Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL co | critical | 9.8 | 5% |
| CVE-2024-1208 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. | medium | 5.3 | 5% |
| CVE-2020-24407 | magento/community-edition, magento/project-community-edition | Magento 2 Community Edition RCE via Unsafe File Upload | critical | 9.1 | 5% |
| CVE-2022-0228 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in | high | 7.2 | 5% |
| CVE-2019-17669 | WordPress core | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of | critical | 9.8 | 5% |
| CVE-2015-7527 | cool-video-gallery (WordPress plugin) | lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters i | high | 7.5 | 5% |
| CVE-2021-25082 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statemen | high | 8.8 | 5% |
| CVE-2010-4879 | dompdf/dompdf | DOMPDF Remote File Inclusion Vulnerability | high | 0.0 | 5% |
| CVE-2013-6281 | dhtmlxspreadsheet (WordPress plugin) | Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows | medium | 4.3 | 5% |
| CVE-2020-28036 | WordPress core | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | critical | 9.8 | 5% |
| CVE-2017-6096 | mail-masta (WordPress plugin) | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Req | high | 7.2 | 5% |
| CVE-2017-6097 | mail-masta (WordPress plugin) | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.p | high | 7.2 | 5% |
| CVE-2020-8091 | typo3/cms | Typo3 Cross-Site Scripting in Flash component (ELTS) | medium | 6.1 | 5% |
| CVE-2015-4614 | easy2map (WordPress plugin) | Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to | high | 7.5 | 5% |
| CVE-2021-24791 | header-footer-code-manager (WordPress plugin) | The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters befo | high | 7.2 | 5% |
| CVE-2021-39348 | learnpress (WordPress plugin) | The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter f | medium | 5.5 | 5% |
| CVE-2018-19274 | phpbb/phpbb | phpBB Remote Code Execution | high | 7.2 | 5% |
| CVE-2017-5610 | WordPress core | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assign | medium | 5.3 | 5% |
| CVE-2007-2821 | WordPress core | SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via | high | 7.5 | 5% |
| CVE-2022-3141 | translatepress (WordPress plugin) | The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (vi | high | 8.8 | 5% |
| CVE-2021-24966 | error-log-viewer (WordPress plugin) | The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to cl | medium | 4.9 | 5% |
| CVE-2022-40734 | unisharp/laravel-filemanager | UniSharp Laravel Filemanager directory traversal vulnerability | medium | 6.5 | 5% |
| CVE-2019-16223 | WordPress core | WordPress before 5.2.3 allows XSS in post previews by authenticated users. | medium | 5.4 | 5% |
| CVE-2020-11548 | search-meter (WordPress plugin) | The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could ac | critical | 9.8 | 5% |
| CVE-2023-30854 | wwbn/avideo | Remote code injection in wwbn/avideo | high | 8.8 | 5% |
| CVE-2017-6098 | mail-masta (WordPress plugin) | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requi | high | 7.2 | 5% |
| CVE-2022-28508 | mantisbt/mantisbt | MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php | medium | 6.1 | 5% |
| CVE-2014-9031 | WordPress core | Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 a | medium | 4.3 | 5% |
| CVE-2020-35949 | quiz-and-survey-master (WordPress plugin) | An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers t | critical | 10.0 | 5% |
| CVE-2016-4793 | cakephp/cakephp | CakePHP allows remote attackers to spoof their IP | high | 7.5 | 5% |
| CVE-2023-0630 | slimstat-analytics (WordPress plugin) | The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes d | high | 8.8 | 5% |
| CVE-2019-15092 | import-export-wordpress-users (WordPress plugin) | The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, displ | high | 7.3 | 5% |
| CVE-2013-2011 | w3-super-cache (WordPress plugin) | WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitr | high | 8.8 | 5% |
| CVE-2017-17043 | emag-marketplace-connector (WordPress plugin) | The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketp | medium | 6.1 | 5% |
| CVE-2022-4050 | joomsport (WordPress plugin) | The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to | critical | 9.8 | 5% |
| CVE-2017-17451 | wp-mailster (WordPress plugin) | The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2 | medium | 6.1 | 5% |
| CVE-2015-3439 | WordPress core | Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3 | medium | 4.3 | 5% |
| CVE-2018-10969 | pie-register (WordPress plugin) | SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands | critical | 9.8 | 5% |
| CVE-2008-0192 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or | medium | 4.3 | 5% |