Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-47615 | learnpress (WordPress plugin) | Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. | critical | 9.3 | 5% |
| CVE-2021-24901 | security-audit (WordPress plugin) | The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users t | medium | 4.8 | 5% |
| CVE-2021-24904 | mortgage-calculators-wp (WordPress plugin) | The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a cal | medium | 4.8 | 5% |
| CVE-2018-12426 | live-chat (WordPress plugin) | The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side va | critical | 9.8 | 5% |
| CVE-2022-30600 | moodle/moodle | Incorrect Calculation in moodle | critical | 9.8 | 5% |
| CVE-2008-1930 | WordPress core | The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allow | high | 7.5 | 5% |
| CVE-2020-9579 | magento/community-edition, magento/core | Magento Security mitigation bypass vulnerability | critical | 9.8 | 5% |
| CVE-2020-9580 | magento/community-edition, magento/core, magento/project-community-edition | Magento Security mitigation bypass vulnerability | critical | 9.8 | 5% |
| CVE-2012-6622 | forumpress (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordP | medium | 4.3 | 5% |
| CVE-2014-9173 | google-document-embedder (WordPress plugin) | SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arb | high | 7.5 | 5% |
| CVE-2024-3136 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template | critical | 9.8 | 5% |
| CVE-2014-9097 | contus-video-gallery (WordPress plugin) | Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed befo | high | 7.5 | 5% |
| CVE-2021-24970 | all-in-one-video-gallery (WordPress plugin) | The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require sta | high | 7.2 | 5% |
| CVE-2022-34253 | magento/community-edition | Magento XML Injection vulnerability in the Widgets Module | critical | 9.1 | 5% |
| CVE-2021-39174 | cachethq/cachet | Cachet configuration leak | high | 8.8 | 5% |
| CVE-2020-9587 | magento/community-edition, magento/core, magento/project-community-edition | Magento authorization bypass vulnerability | high | 7.5 | 5% |
| CVE-2019-20141 | neon (WordPress theme) | An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter. | medium | 6.1 | 5% |
| CVE-2015-7683 | font (WordPress plugin) | Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitra | medium | 4.0 | 5% |
| CVE-2008-1304 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the | medium | 4.3 | 5% |
| CVE-2015-9272 | video-presentation (WordPress plugin) | The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php | critical | 9.8 | 5% |
| CVE-2020-24914 | qcubed/qcubed | qcubed PHP object injection | critical | 9.8 | 5% |
| CVE-2018-7667 | vrana/adminer | vrana/adminer vulnerable to SSRF by connecting to privileged ports | medium | 0.0 | 5% |
| CVE-2013-1401 | wordpress-poll (WordPress plugin) | Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 | critical | 9.8 | 5% |
| CVE-2015-5237 | google/protobuf | protobuf susceptible to buffer overflow | high | 8.8 | 5% |
| CVE-2018-11525 | woo-order-export-lite (WordPress plugin) | The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection. | high | 7.8 | 5% |
| CVE-2018-11526 | comments-import-export-woocommerce (WordPress plugin) | The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection. | high | 7.8 | 5% |
| CVE-2015-5733 | WordPress core | Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4 | medium | 4.3 | 5% |
| CVE-2021-24453 | include-me (WordPress plugin) | The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Executio | high | 8.8 | 5% |
| CVE-2023-5815 | blog-designer-pack (WordPress plugin) | The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post M | high | 8.1 | 5% |
| CVE-2023-1020 | wp-live-chat-shoutbox (WordPress plugin) | The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement | critical | 9.8 | 5% |
| CVE-2020-9585 | magento/community-edition, magento/core, magento/project-community-edition | Magento Defense-in-depth security mitigation vulnerability | critical | 9.8 | 5% |
| CVE-2012-6625 | forumpress (WordPress plugin) | SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attac | high | 7.5 | 5% |
| CVE-2017-9603 | wp-jobs (WordPress plugin) | SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via | high | 8.8 | 5% |
| CVE-2019-6780 | wise-chat (WordPress plugin) | The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noo | medium | 6.1 | 5% |
| CVE-2022-29221 | smarty/smarty | PHP Code Injection by malicious block or filename in Smarty | high | 8.8 | 5% |
| CVE-2015-5622 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML | low | 3.5 | 5% |
| CVE-2018-19487 | wp-jobhunt (WordPress plugin) | The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function throug | high | 7.5 | 5% |
| CVE-2015-2321 | job-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitr | medium | 4.3 | 5% |
| CVE-2014-5347 | disqus-comment-system (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attack | medium | 6.8 | 5% |
| CVE-2020-8819 | cardgate/woocommerce | CardGate Payments plugin for WooCommerce does not validate request origin | high | 8.1 | 5% |
| CVE-2018-5315 | wp-events-calendar (WordPress plugin) | The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php. | critical | 9.8 | 5% |
| CVE-2015-3314 | tune-library (WordPress plugin) | SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5. | high | 8.1 | 5% |
| CVE-2020-11732 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download. | high | 7.5 | 5% |
| CVE-2022-1001 | wp-downgrade (WordPress plugin) | The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not | medium | 4.8 | 5% |
| CVE-2022-4407 | thorsten/phpmyfaq | phpMyFAQ vulnerable to Cross-site Scripting | medium | 6.1 | 5% |
| CVE-2021-21016 | magento/community-edition, magento/project-community-edition | Magento OS command injection via the WebAPI | critical | 9.1 | 5% |
| CVE-2022-4059 | cryptocurrency-widgets-pack (WordPress plugin) | The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement v | critical | 9.8 | 5% |
| CVE-2022-35653 | moodle/moodle | Moodle LTI module reflected XSS risk | medium | 6.1 | 5% |
| CVE-2022-34140 | feehi/cms | Feehi CMS Cross-site Scripting | medium | 5.4 | 5% |
| CVE-2006-0733 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable at | low | 2.6 | 5% |