Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2013-7319 | download-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitra | medium | 4.3 | 5% |
| CVE-2014-4513 | activehelper-livehelp-live-chat (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier fo | medium | 4.3 | 5% |
| CVE-2021-26830 | tribalsystems/zenario | SQL Injection in tribalsystems/zenario | critical | 9.1 | 5% |
| CVE-2025-13390 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrec | critical | 10.0 | 5% |
| CVE-2022-2544 | ninja-job-board (WordPress plugin) | The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to u | high | 7.5 | 5% |
| CVE-2020-7995 | dolibarr/dolibarr | Dolibarr Improper Restriction of Excessive Authentication Attempts | critical | 9.8 | 5% |
| CVE-2014-4942 | wp-easycart (WordPress plugin) | The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct reques | medium | 5.0 | 5% |
| CVE-2019-20041 | WordPress core | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass | critical | 9.8 | 5% |
| CVE-2019-15647 | groundhogg (WordPress plugin) | The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution. | high | 8.8 | 5% |
| CVE-2013-1409 | commentluv (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 5% |
| CVE-2015-4084 | free-counter (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 5% |
| CVE-2019-10874 | bolt/bolt | Bolt Cross Site Request Forgery (CSRF) | high | 8.8 | 5% |
| CVE-2023-34448 | getgrav/grav | Grav Server-side Template Injection (SSTI) via Twig Default Filters | high | 7.2 | 5% |
| CVE-2019-17670 | WordPress core | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation | critical | 9.8 | 5% |
| CVE-2014-3842 | imember360 (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to | medium | 4.3 | 5% |
| CVE-2021-4380 | pinterest-automatic-pin (WordPress plugin) | The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_aut | critical | 9.8 | 4% |
| CVE-2016-1000153 | tidio-gallery (WordPress plugin) | Reflected XSS in wordpress plugin tidio-gallery v1.1 | medium | 6.1 | 4% |
| CVE-2016-1000155 | wpsolr-search-engine (WordPress plugin) | Reflected XSS in wordpress plugin wpsolr-search-engine v7.6 | medium | 6.1 | 4% |
| CVE-2019-11869 | yuzo (WordPress plugin) | The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes fr | medium | 6.1 | 4% |
| CVE-2019-14313 | photo-gallery (WordPress plugin) | A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerab | critical | 9.8 | 4% |
| CVE-2014-5013 | dompdf/dompdf | DOMPDF Remote Code Execution | high | 8.8 | 4% |
| CVE-2018-19799 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 4% |
| CVE-2022-24899 | contao/contao, contao/core-bundle | Cross site scripting via canonical tag in Contao | high | 7.2 | 4% |
| CVE-2026-26990 | librenms/librenms | LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php | high | 8.8 | 4% |
| CVE-2019-25141 | easy-wp-smtp (WordPress plugin) | The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing | critical | 9.8 | 4% |
| CVE-2012-1188 | forkcms/forkcms | Fork CMS Multiple XSS Vulnerabilities | medium | 0.0 | 4% |
| CVE-2020-11930 | gtranslate (WordPress plugin) | The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature withi | medium | 6.1 | 4% |
| CVE-2021-24329 | wp-super-cache (WordPress plugin) | The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead | medium | 5.4 | 4% |
| CVE-2016-1000137 | hero-maps-pro (WordPress plugin) | Reflected XSS in wordpress plugin hero-maps-pro v2.1.0 | medium | 6.1 | 4% |
| CVE-2016-1000142 | parsi-font (WordPress plugin) | Reflected XSS in wordpress plugin parsi-font v4.2.5 | medium | 6.1 | 4% |
| CVE-2016-2221 | WordPress core | Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attack | high | 7.4 | 4% |
| CVE-2024-11613 | wordpress-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in a | critical | 9.8 | 4% |
| CVE-2019-14798 | photo-gallery (WordPress plugin) | The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/ad | medium | 4.9 | 4% |
| CVE-2020-10385 | wpforms-lite (WordPress plugin) | A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress. | medium | 5.4 | 4% |
| CVE-2022-4328 | woocommerce-checkout-field-manager (WordPress plugin) | The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticate | critical | 9.8 | 4% |
| CVE-2016-1000132 | enhanced-tooltipglossary (WordPress plugin) | Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8 | medium | 6.1 | 4% |
| CVE-2012-6652 | page-flip-book (WordPress plugin) | Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remot | critical | 9.8 | 4% |
| CVE-2018-10504 | form-maker (WordPress plugin) | The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. | high | 7.8 | 4% |
| CVE-2015-7377 | pie-register (WordPress plugin) | Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remo | medium | 4.3 | 4% |
| CVE-2018-7747 | caldera-forms (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to in | medium | 4.8 | 4% |
| CVE-2022-0750 | photoswipe-masonry (WordPress plugin) | The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the t | medium | 6.4 | 4% |
| CVE-2026-42607 | getgrav/grav | Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature | critical | 9.1 | 4% |
| CVE-2007-5105 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web scrip | medium | 4.3 | 4% |
| CVE-2020-26153 | event-espresso (WordPress plugin) | A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overvie | medium | 6.1 | 4% |
| CVE-2022-33965 | wp-stats-manager (WordPress plugin) | Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress. | critical | 9.3 | 4% |
| CVE-2019-13573 | fv-wordpress-flowplayer (WordPress plugin) | A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploi | critical | 9.8 | 4% |
| CVE-2021-3924 | getgrav/grav | Path traversal in grav | high | 8.8 | 4% |
| CVE-2022-0210 | random-banner (WordPress plugin) | The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter foun | medium | 4.8 | 4% |
| CVE-2019-1010257 | article2pdf (WordPress plugin) | An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, | critical | 9.1 | 4% |
| CVE-2014-5200 | fb-gorilla (WordPress plugin) | SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute arbitrary SQL command | high | 7.5 | 4% |