Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6460 | grow (WordPress plugin) | The Grow by Tradedoubler WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it p | critical | 9.8 | 5% |
| CVE-2023-2996 | jetpack (WordPress plugin) | The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existin | high | 8.8 | 5% |
| CVE-2015-7235 | cp-reservation-calendar (WordPress plugin) | Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote | high | 7.5 | 5% |
| CVE-2017-15374 | shopware/shopware | Shopware XSS Vulnerability | medium | 6.1 | 5% |
| CVE-2015-5681 | powerplay-gallery (WordPress plugin) | Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute ar | high | 7.5 | 5% |
| CVE-2022-3982 | booking-calendar (WordPress plugin) | The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthent | critical | 9.8 | 5% |
| CVE-2024-10571 | chart-builder (WordPress plugin) | The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 | critical | 9.8 | 5% |
| CVE-2022-4049 | wp-user (WordPress plugin) | The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a | critical | 9.8 | 5% |
| CVE-2022-4447 | fontsy (WordPress plugin) | The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX a | critical | 9.8 | 5% |
| CVE-2022-2461 | transposh-translation-filter-for-wordpress (WordPress plugin) | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions | medium | 5.3 | 5% |
| CVE-2013-7187 | formcraft (WordPress plugin) | SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary | high | 7.5 | 5% |
| CVE-2020-28413 | mantisbt/mantisbt | MantisBT SQL Injection via mc_project_get_users function | medium | 5.3 | 5% |
| CVE-2012-10020 | foxypress (WordPress plugin) | The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in | critical | 9.8 | 5% |
| CVE-2021-36440 | showdoc/showdoc | Unrestricted File Upload in ShowDoc v2.9.5 | critical | 9.8 | 5% |
| CVE-2021-29472 | composer/composer | Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial | high | 8.8 | 5% |
| CVE-2022-25481 | topthink/framework | Exposure of Resource to Wrong Sphere in ThinkPHP Framework | high | 7.5 | 5% |
| CVE-2015-3325 | wp-symposium (WordPress plugin) | SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary S | high | 7.5 | 5% |
| CVE-2019-14206 | adaptive-images (WordPress plugin) | An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete a | high | 7.5 | 5% |
| CVE-2014-5187 | tom-m8te-plugin (WordPress plugin) | Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via | medium | 5.0 | 5% |
| CVE-2009-2853 | WordPress core | Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, | high | 10.0 | 5% |
| CVE-2021-24404 | wp-board (WordPress plugin) | The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised, escaped or validat | high | 8.8 | 5% |
| CVE-2021-43789 | prestashop/prestashop | SQL injection in prestashop/prestashop | high | 7.5 | 5% |
| CVE-2015-4010 | encrypted-contact-form (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hij | medium | 6.8 | 5% |
| CVE-2021-24295 | spam-protection\,-antispam\,-firewall (WordPress plugin) | It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by Cle | high | 7.5 | 5% |
| CVE-2021-24247 | contact-form-check-tester (WordPress plugin) | The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking a | medium | 5.4 | 5% |
| CVE-2014-2053 | james-heinrich/getid3 | getID3 is vulnerable to XML External Entity (XXE) | high | 0.0 | 5% |
| CVE-2014-3544 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 5% |
| CVE-2014-4972 | ajax-upload-for-gravity-forms (WordPress plugin) | Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute ar | critical | 9.8 | 5% |
| CVE-2016-1000131 | e-search (WordPress plugin) | Reflected XSS in wordpress plugin e-search v1.0 | medium | 6.1 | 5% |
| CVE-2016-1000134 | hdw-tube (WordPress plugin) | Reflected XSS in wordpress plugin hdw-tube v1.2 | medium | 6.1 | 5% |
| CVE-2016-1000135 | hdw-tube (WordPress plugin) | Reflected XSS in wordpress plugin hdw-tube v1.2 | medium | 6.1 | 5% |
| CVE-2021-24401 | wp-domain-redirect (WordPress plugin) | The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an `editid` parameter which is not sanitised, escap | high | 7.2 | 5% |
| CVE-2021-24402 | wp-icommerce (WordPress plugin) | The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or v | high | 7.2 | 5% |
| CVE-2014-9178 | sp-project-\&-document-manager (WordPress plugin) | Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-docum | high | 7.5 | 5% |
| CVE-2019-10774 | mikehaertl/php-shellcommand | php-shellcommand command injection vulnerability | critical | 9.8 | 5% |
| CVE-2019-14230 | onionbuzz (WordPress plugin) | An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set | critical | 9.8 | 5% |
| CVE-2019-14231 | onionbuzz (WordPress plugin) | An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the | critical | 9.8 | 5% |
| CVE-2019-16172 | limesurvey/limesurvey | Cross-site Scripting in LimeSurvey | medium | 5.4 | 5% |
| CVE-2019-16117 | photo-gallery (WordPress plugin) | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.p | medium | 6.1 | 5% |
| CVE-2015-10135 | wpshop (WordPress plugin) | The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload | critical | 9.8 | 5% |
| CVE-2018-14630 | moodle/moodle | Moodle XML import of ddwtos could lead to intentional remote code execution | high | 8.8 | 5% |
| CVE-2014-6412 | WordPress core | WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach. | high | 8.1 | 5% |
| CVE-2014-10013 | awp-classifieds (WordPress plugin) | SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQ | high | 7.5 | 5% |
| CVE-2014-5189 | lead-octopus (WordPress plugin) | SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers to execute arbitrar | high | 7.5 | 5% |
| CVE-2014-5201 | gallery-objects (WordPress plugin) | SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via th | high | 7.5 | 5% |
| CVE-2014-9175 | wpdatatables (WordPress plugin) | SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execut | high | 7.5 | 5% |
| CVE-2015-2090 | wp-survey-and-poll (WordPress plugin) | SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows r | high | 7.5 | 5% |
| CVE-2015-2216 | photocrati (WordPress theme) | SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL co | high | 7.5 | 5% |
| CVE-2008-6767 | WordPress core | wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of servic | high | 10.0 | 5% |
| CVE-2022-29933 | craftcms/cms | Improper account password reset in Craft CMS | high | 8.8 | 5% |