Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2011-4932 | impresspages/impresspages | ImpressPages CMS eval injection vulnerability | high | 0.0 | 4% |
| CVE-2025-65093 | librenms/librenms | LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint | medium | 5.5 | 4% |
| CVE-2014-4550 | ninja (WordPress plugin) | Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allow | medium | 6.1 | 4% |
| CVE-2011-4962 | silverstripe/cms | Silverstripe CMS Arbitrary Code Execution | medium | 0.0 | 4% |
| CVE-2019-11832 | typo3/cms, typo3/cms-core | TYPO3 Image Processing susceptible to Code Execution | high | 7.5 | 4% |
| CVE-2013-1765 | smart-flv (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject a | medium | 4.3 | 4% |
| CVE-2023-0037 | map-builder-for-google-maps (WordPress plugin) | The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them | critical | 9.8 | 4% |
| CVE-2014-9038 | WordPress core | wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cond | medium | 6.4 | 4% |
| CVE-2015-4065 | landing-pages (WordPress plugin) | Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress | low | 3.5 | 4% |
| CVE-2017-12062 | mantisbt/mantisbt | MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php | medium | 6.1 | 4% |
| CVE-2022-3477 | newsmag (WordPress plugin), newspaper (WordPress plugin), tagdiv-composer (WordPress plugin) | The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5. | critical | 9.8 | 4% |
| CVE-2014-4536 | infusionsoft (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms | medium | 6.1 | 4% |
| CVE-2017-6381 | drupal/core, drupal/drupal | Drupal Remote code execution | high | 8.1 | 4% |
| CVE-2014-5203 | WordPress core | wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to exec | high | 7.5 | 4% |
| CVE-2019-19212 | dolibarr/dolibarr | Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php | critical | 9.8 | 4% |
| CVE-2021-24335 | car-repair-services-\&-auto-mechanic (WordPress plugin) | The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before | medium | 6.1 | 4% |
| CVE-2025-68614 | librenms/librenms | LibreNMS Alert Rule API Cross-Site Scripting Vulnerability | medium | 4.3 | 4% |
| CVE-2019-15873 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax. | high | 8.8 | 4% |
| CVE-2023-3197 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and inclu | critical | 9.8 | 4% |
| CVE-2022-0378 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 4% |
| CVE-2022-0381 | embed-swagger (WordPress plugin) | The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation | medium | 6.1 | 4% |
| CVE-2014-9311 | shareaholic (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated use | low | 3.5 | 4% |
| CVE-2015-1000006 | recent-backups (WordPress plugin) | Remote file download vulnerability in recent-backups v0.7 wordpress plugin | high | 7.5 | 4% |
| CVE-2020-6008 | lifterlms (WordPress plugin) | LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution | critical | 9.8 | 4% |
| CVE-2012-10019 | front-end-editor (WordPress plugin) | The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php fil | critical | 9.8 | 4% |
| CVE-2013-7233 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlie | medium | 6.8 | 4% |
| CVE-2022-0140 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users t | medium | 5.3 | 4% |
| CVE-2015-6920 | sourceafrica (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject a | medium | 4.3 | 4% |
| CVE-2018-20676 | twbs/bootstrap | XSS vulnerability that affects bootstrap | medium | 6.1 | 4% |
| CVE-2022-0765 | loco-translate (WordPress plugin) | The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings befo | medium | 5.4 | 4% |
| CVE-2022-2431 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to i | high | 8.1 | 4% |
| CVE-2015-2755 | ab-google-map-travel (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote | medium | 6.8 | 4% |
| CVE-2020-22345 | centreon/centreon | OS Command Injection in Centreon | high | 8.8 | 4% |
| CVE-2014-4561 | ultimate-weather (WordPress plugin) | The ultimate-weather plugin 1.0 for WordPress has XSS | medium | 6.1 | 4% |
| CVE-2015-4064 | landing-pages (WordPress plugin) | SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authentica | medium | 6.5 | 4% |
| CVE-2022-4681 | hide-my-wp (WordPress plugin) | The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJA | critical | 9.8 | 4% |
| CVE-2023-26326 | buddyforms (WordPress plugin) | The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthent | critical | 9.8 | 4% |
| CVE-2020-9692 | magento/community-edition | Magento security mitigation bypass vulnerability | medium | 6.5 | 4% |
| CVE-2023-2734 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insuffici | critical | 9.8 | 4% |
| CVE-2017-1000600 | WordPress core | WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. Th | high | 8.8 | 4% |
| CVE-2018-9019 | dolibarr/dolibarr | Dolibarr SQL Injection vulnerability | critical | 9.8 | 4% |
| CVE-2016-5835 | WordPress core | WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, re | high | 7.5 | 4% |
| CVE-2023-4666 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allow | critical | 9.8 | 4% |
| CVE-2020-13625 | phpmailer/phpmailer | Insufficient output escaping of attachment names in PHPMailer | high | 7.5 | 4% |
| CVE-2014-4544 | podcast-channels (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arb | medium | 6.1 | 4% |
| CVE-2015-2792 | wpml (WordPress plugin) | The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass n | high | 7.5 | 4% |
| CVE-2024-8484 | rest-api-to-miniprogram (WordPress plugin) | The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/ | high | 7.5 | 4% |
| CVE-2015-3933 | genix/cms | MetalGenix GeniXCMS vulnerable to SQL Injection | critical | 9.8 | 4% |
| CVE-2020-15038 | coming-soon (WordPress plugin) | The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS. | medium | 5.4 | 4% |
| CVE-2021-24389 | foodbakery (WordPress plugin) | The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_ra | medium | 6.1 | 4% |