Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0261 | wp-tripadvisor-review-slider (WordPress plugin) | The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL sta | high | 8.8 | 4% |
| CVE-2018-1002000 | bft-autoresponder (WordPress plugin) | There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privile | high | 7.2 | 4% |
| CVE-2019-11185 | wp-live-chat-support (WordPress plugin) | The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incom | critical | 9.8 | 4% |
| CVE-2020-35590 | limit-login-attempts-reloaded (WordPress plugin) | LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limi | critical | 9.8 | 4% |
| CVE-2019-6726 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fas | medium | 6.5 | 4% |
| CVE-2021-24150 | likebtn-like-button (WordPress plugin) | The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Re | high | 7.5 | 4% |
| CVE-2023-5561 | WordPress core | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the em | medium | 5.3 | 4% |
| CVE-2015-9271 | video-conference (WordPress plugin) | The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code bec | critical | 9.8 | 4% |
| CVE-2013-1408 | wysija-newsletters (WordPress plugin) | Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators | medium | 6.5 | 4% |
| CVE-2018-14041 | twbs/bootstrap, typo3/cms, typo3/cms-core | Bootstrap Cross-site Scripting vulnerability | medium | 6.1 | 4% |
| CVE-2014-4941 | wp-cross-rss (WordPress plugin) | Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files v | medium | 5.0 | 4% |
| CVE-2020-36719 | listingpro (WordPress plugin) | The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivati | critical | 9.8 | 4% |
| CVE-2022-4093 | dolibarr/dolibarr | SQL injection in Dolibarr | critical | 9.8 | 4% |
| CVE-2016-2403 | symfony/security, symfony/security-core, symfony/symfony | Symfony Authentication Bypass | critical | 9.8 | 4% |
| CVE-2022-0236 | wp-import-export (WordPress plugin), wp-import-export-lite (WordPress plugin) | The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a m | high | 7.5 | 4% |
| CVE-2022-0165 | kingcomposer (WordPress plugin) | The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc | medium | 6.1 | 4% |
| CVE-2008-2392 | WordPress core | Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute | high | 9.0 | 4% |
| CVE-2020-23653 | zoujingli/thinkadmin | ThinkAdmin insecure unserialize vulnerability | critical | 9.8 | 4% |
| CVE-2026-33482 | wwbn/avideo | AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() | high | 8.1 | 4% |
| CVE-2022-45808 | learnpress (WordPress plugin) | SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. | critical | 9.9 | 4% |
| CVE-2021-24684 | pdf-light-viewer (WordPress plugin) | The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the s | high | 8.8 | 4% |
| CVE-2014-5181 | lastfm-rotation-plugin (WordPress plugin) | Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attac | medium | 5.0 | 4% |
| CVE-2020-28035 | WordPress core | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. | critical | 9.8 | 4% |
| CVE-2018-10102 | WordPress core | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag. | medium | 6.1 | 4% |
| CVE-2008-0616 | dmsguestbook (WordPress plugin) | SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administr | medium | 6.5 | 4% |
| CVE-2018-20150 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. | medium | 6.1 | 4% |
| CVE-2018-11587 | centreon/centreon | Centreon RCE Vulnerability | critical | 9.8 | 4% |
| CVE-2024-44902 | topthink/framework | ThinkPHP deserialization vulnerability | critical | 9.8 | 4% |
| CVE-2015-10138 | work-the-flow-file-upload (WordPress plugin) | The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery | critical | 9.8 | 4% |
| CVE-2015-4066 | gigpress (WordPress plugin) | Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated us | medium | 6.5 | 4% |
| CVE-2023-0600 | visitor-statistics (WordPress plugin) | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, | critical | 9.8 | 4% |
| CVE-2014-100003 | yourmembers (WordPress plugin) | SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for WordPress allows remote | high | 7.5 | 4% |
| CVE-2025-34086 | bolt/bolt | Bolt CMS vulnerable to authenticated remote code execution | high | 0.0 | 4% |
| CVE-2021-21014 | magento/community-edition, magento/project-community-edition | Magento vulnerable to a file upload restriction bypass | critical | 9.1 | 4% |
| CVE-2022-1054 | rsvp-and-event-management (WordPress plugin) | The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and ha | medium | 5.3 | 4% |
| CVE-2014-4558 | swipehq-payment-gateway-woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress all | medium | 6.1 | 4% |
| CVE-2015-7517 | double-opt-in-for-download (WordPress plugin) | Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute | critical | 9.8 | 4% |
| CVE-2016-1000128 | anti-plagiarism (WordPress plugin) | Reflected XSS in wordpress plugin anti-plagiarism v3.60 | medium | 6.1 | 4% |
| CVE-2016-1000139 | infusionsoft (WordPress plugin) | Reflected XSS in wordpress plugin infusionsoft v1.5.11 | medium | 6.1 | 4% |
| CVE-2024-4898 | instawp-connect (WordPress plugin) | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authori | critical | 9.8 | 4% |
| CVE-2019-19634 | verot/class.upload.php | class.upload.php in verot.net omits .pht from the set of dangerous file extensions | critical | 9.8 | 4% |
| CVE-2015-2218 | wonderplugin-audio-player (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Pla | medium | 4.3 | 4% |
| CVE-2018-18461 | bft-autoresponder (WordPress plugin) | The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary | critical | 9.8 | 4% |
| CVE-2015-4465 | zm-ajax-login-register (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject | medium | 4.3 | 4% |
| CVE-2018-8710 | woocommerce-products-filter (WordPress plugin) | A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrate | critical | 9.8 | 4% |
| CVE-2016-1000152 | tidio-form (WordPress plugin) | Reflected XSS in wordpress plugin tidio-form v1.0 | medium | 6.1 | 4% |
| CVE-2020-8818 | cardgate/magento2 | Origin Validation Error in Magento 2 | high | 8.1 | 4% |
| CVE-2018-19488 | wp-jobhunt (WordPress plugin) | The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin | critical | 9.8 | 4% |
| CVE-2022-0439 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `aja | high | 8.8 | 4% |
| CVE-2014-6242 | all-in-one-wp-security-and-firewall (WordPress plugin) | Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated | medium | 6.5 | 4% |