Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-6312 | login-sidebar-widget (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before 3.2.1 for WordPress | medium | 4.3 | 4% |
| CVE-2024-3605 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms RE | critical | 10.0 | 4% |
| CVE-2020-9689 | magento/community-edition, magento/project-community-edition | Magento path traversal vulnerability | medium | 6.5 | 4% |
| CVE-2018-14040 | twbs/bootstrap | Bootstrap vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 4% |
| CVE-2024-6205 | payplus-payment-gateway (WordPress plugin) | The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL stateme | critical | 9.8 | 4% |
| CVE-2022-26986 | impresscms/impresscms | SQL injection in ImpressCMS | high | 7.2 | 4% |
| CVE-2015-9463 | s3bubble-amazon-s3-audio-streaming (WordPress plugin) | The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/down | high | 7.5 | 4% |
| CVE-2015-9470 | history-collection (WordPress plugin) | The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter. | high | 7.5 | 4% |
| CVE-2016-4861 | zendframework/zendframework | Zend Framework Allows SQL Injection | critical | 9.8 | 4% |
| CVE-2021-34622 | profilepress (WordPress plugin) | A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugi | critical | 9.8 | 4% |
| CVE-2016-5836 | WordPress core | The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors. | high | 7.5 | 4% |
| CVE-2020-28039 | WordPress core | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine wh | critical | 9.1 | 4% |
| CVE-2012-2572 | threewp-email-reflector (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject a | medium | 4.3 | 4% |
| CVE-2021-24581 | blue-admin (WordPress plugin) | The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading t | high | 8.8 | 4% |
| CVE-2023-3134 | forminator (WordPress plugin) | The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-popul | medium | 6.1 | 4% |
| CVE-2013-5978 | cart66-lite (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote att | medium | 6.1 | 4% |
| CVE-2024-8425 | woocommerce-ultimate-gift-card (WordPress plugin) | The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in | critical | 9.8 | 4% |
| CVE-2017-9065 | WordPress core | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. | high | 7.5 | 4% |
| CVE-2017-9834 | watupro (WordPress plugin) | SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via | critical | 9.8 | 4% |
| CVE-2021-27909 | mautic/core | XSS vulnerability on password reset page | medium | 6.3 | 4% |
| CVE-2018-10188 | phpmyadmin/phpmyadmin | phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution | high | 8.8 | 4% |
| CVE-2016-10735 | twbs/bootstrap | Bootstrap Cross-site Scripting vulnerability | medium | 6.1 | 4% |
| CVE-2014-4592 | wp-planet (WordPress plugin) | Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows | medium | 6.1 | 4% |
| CVE-2017-15284 | october/rain | OctoberCMS Cross-Site Scripting | medium | 5.4 | 4% |
| CVE-2020-29156 | woocommerce (WordPress plugin), woocommerce/woocommerce | The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter | medium | 5.3 | 4% |
| CVE-2022-3481 | woocommerce-dropshipping (WordPress plugin) | The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statemen | critical | 9.8 | 4% |
| CVE-2017-9288 | raygun4wp (WordPress plugin) | The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter). | medium | 6.1 | 4% |
| CVE-2018-14042 | twbs/bootstrap | Bootstrap Cross-site Scripting vulnerability | medium | 6.1 | 4% |
| CVE-2022-24894 | symfony/http-kernel, symfony/symfony | Symfony storing cookie headers in HttpCache | medium | 5.9 | 4% |
| CVE-2019-13571 | advanced-cf7-db (WordPress plugin) | A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of th | critical | 9.8 | 4% |
| CVE-2022-3768 | wpsmartcontracts (WordPress plugin) | The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, le | high | 8.8 | 4% |
| CVE-2021-21018 | magento/community-edition | Magento OS Command Injection | critical | 9.1 | 4% |
| CVE-2018-20677 | twbs/bootstrap | bootstrap Cross-site Scripting vulnerability | medium | 6.1 | 4% |
| CVE-2014-4535 | import-legacy-media (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject a | medium | 6.1 | 4% |
| CVE-2014-4539 | movies (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web | medium | 6.1 | 4% |
| CVE-2022-3634 | contact-form-7-database-addon (WordPress plugin) | The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead | critical | 9.8 | 4% |
| CVE-2016-1000149 | simpel-reserveren (WordPress plugin) | Reflected XSS in wordpress plugin simpel-reserveren v3.5.2 | medium | 6.1 | 4% |
| CVE-2016-9187 | moodle/moodle | Moodle Unrestricted file upload vulnerability | high | 8.8 | 4% |
| CVE-2018-20462 | jsmol2wp (WordPress plugin) | An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inj | medium | 6.1 | 4% |
| CVE-2016-6633 | phpmyadmin/phpmyadmin | phpMyAdmin Remote code execution vulnerability when PHP is running with dbase extension | high | 8.1 | 4% |
| CVE-2008-0193 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remot | medium | 4.3 | 4% |
| CVE-2016-4029 | WordPress core | WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote at | high | 8.6 | 4% |
| CVE-2015-9471 | dzs-zoomsounds (WordPress plugin) | The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload. | critical | 9.8 | 4% |
| CVE-2020-9630 | magento/community-edition, magento/core, magento/project-community-edition | Magento business logic error vulnerability | critical | 9.8 | 4% |
| CVE-2008-3233 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 2.6, SVN development versions only, allows remote attackers to inject arbitrary | medium | 4.3 | 4% |
| CVE-2021-24220 | ignition (WordPress plugin), luxe (WordPress plugin), minus (WordPress plugin) +6 more | Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Them | critical | 9.1 | 4% |
| CVE-2021-33816 | dolibarr/dolibarr | Dolibarr remote PHP code execution | critical | 9.8 | 4% |
| CVE-2017-1000009 | akeneo/pim-community-dev | Akeneo PIM vulnerable to shell injection in the mass edition | critical | 9.8 | 4% |
| CVE-2020-5237 | oneup/uploader-bundle | Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle | high | 8.8 | 4% |
| CVE-2023-0877 | froxlor/froxlor | Code Injection in froxlor/froxlor | high | 8.8 | 4% |