Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2012-6624 | soundcloud-is-gold (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web | medium | 4.3 | 4% |
| CVE-2014-8800 | nextend-facebook-connect (WordPress plugin) | Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress | medium | 4.3 | 4% |
| CVE-2022-21664 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanit | high | 7.4 | 4% |
| CVE-2006-4028 | WordPress core | Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. NOTE: due to lack of details, | high | 10.0 | 4% |
| CVE-2008-0194 | WordPress core | Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete | high | 7.5 | 4% |
| CVE-2014-4577 | wp-amasin---the-amazon-affiliate-shop (WordPress plugin) | Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress all | medium | 5.0 | 4% |
| CVE-2024-5488 | seopress (WordPress plugin) | The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injectio | critical | 9.8 | 4% |
| CVE-2018-10310 | uk-cookie-consent (WordPress plugin) | A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3 | medium | 5.4 | 4% |
| CVE-2023-0224 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated | critical | 9.8 | 4% |
| CVE-2013-4454 | portable-phpmyadmin (WordPress plugin) | WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities | critical | 9.1 | 4% |
| CVE-2022-0968 | microweber/microweber | Integer Overflow in microweber | high | 7.2 | 4% |
| CVE-2012-2579 | wp-simplemail (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP SimpleMail plugin 1.0.6 for WordPress allow remote attackers to inject arbitra | medium | 4.3 | 4% |
| CVE-2012-2580 | postie (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Postie plugin 1.4.3, and possibly before 1.5.15, for WordPress allows remote attackers to in | medium | 4.3 | 4% |
| CVE-2012-2583 | mini-mail-dashboard-widget (WordPress plugin) | Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary | medium | 4.3 | 4% |
| CVE-2019-1000031 | article2pdf (WordPress plugin) | A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visitin | high | 7.5 | 4% |
| CVE-2015-9228 | nextgen-gallery (WordPress plugin) | In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, | high | 8.8 | 4% |
| CVE-2020-15364 | nexos (WordPress theme) | The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS. | medium | 6.1 | 4% |
| CVE-2018-16975 | elefant/cms | Elefant CMS PHP Code Execution Vulnerability | critical | 9.8 | 4% |
| CVE-2021-24376 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Se | critical | 9.8 | 4% |
| CVE-2015-9464 | s3bubble-amazon-s3-html-5-video-with-adverts (WordPress plugin) | The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/co | high | 7.5 | 4% |
| CVE-2020-25627 | moodle/moodle | Moodle stored Cross-site Scripting (XSS) | medium | 6.1 | 4% |
| CVE-2014-8948 | imember360 (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hi | medium | 6.8 | 4% |
| CVE-2015-4018 | feedwordpress (WordPress plugin) | SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remo | medium | 6.5 | 4% |
| CVE-2016-1000126 | admin-font-editor (WordPress plugin) | Reflected XSS in wordpress plugin admin-font-editor v1.8 | medium | 6.1 | 4% |
| CVE-2016-1000127 | ajax-random-post (WordPress plugin) | Reflected XSS in wordpress plugin ajax-random-post v2.00 | medium | 6.1 | 4% |
| CVE-2022-2462 | transposh-translation-filter-for-wordpress (WordPress plugin) | The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versi | medium | 5.3 | 4% |
| CVE-2018-6195 | wp-splashing-images (WordPress plugin) | admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authentica | high | 7.2 | 4% |
| CVE-2024-10781 | cleantalk-spam-protect (WordPress plugin) | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due t | high | 8.1 | 4% |
| CVE-2014-3541 | moodle/moodle | Moodle vulnerable to PHP object injection attacks | high | 0.0 | 4% |
| CVE-2019-14788 | newsletters-lite (WordPress plugin) | wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory t | high | 8.8 | 4% |
| CVE-2018-20418 | craftcms/cms | Craft CMS Cross-site Scripting (XSS) Vulnerability | medium | 4.8 | 4% |
| CVE-2018-5287 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-abo | high | 7.5 | 4% |
| CVE-2018-5289 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-inf | high | 7.5 | 4% |
| CVE-2018-5290 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tra | high | 7.5 | 4% |
| CVE-2018-5291 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-too | high | 7.5 | 4% |
| CVE-2022-21663 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with | medium | 6.6 | 4% |
| CVE-2024-20720 | magento/community-edition, magento/project-community-edition | Magento Open Source allows OS Command Injection | critical | 9.1 | 4% |
| CVE-2018-5316 | sagepay-server-gateway-for-woocommerce (WordPress plugin) | The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter. | medium | 6.1 | 4% |
| CVE-2019-13569 | email-subscribers (WordPress plugin) | A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitat | critical | 9.8 | 4% |
| CVE-2021-24387 | real-estate-7 (WordPress plugin) | The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before | medium | 6.1 | 4% |
| CVE-2019-16173 | limesurvey/limesurvey | Cross-site Scripting in LimeSurvey | medium | 5.4 | 4% |
| CVE-2017-9066 | WordPress core | In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. | high | 8.6 | 4% |
| CVE-2018-14840 | intelliants/subrion | Subrion CMS Cross-site Scripting | medium | 6.1 | 4% |
| CVE-2013-4241 | hms-testimonials (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inj | medium | 6.1 | 4% |
| CVE-2024-8926 | PHP engine | PHP-CGI cgi.force_redirect bypass on non-standard code pages (incomplete CVE-2024-4577 fix) | high | 7.5 | 4% |
| CVE-2015-9473 | estrutura-basica (WordPress theme) | The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter. | high | 7.5 | 4% |
| CVE-2024-10763 | campress (WordPress theme) | The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocomme | critical | 9.8 | 4% |
| CVE-2018-5233 | getgrav/grav | Grav CMS Cross-site scripting (XSS) vulnerability | medium | 6.1 | 4% |
| CVE-2022-25866 | czproject/git-php | Command injection in czproject/git-php | high | 8.1 | 4% |
| CVE-2014-1836 | impresscms/impresscms | ImpressCMS Path Traversal to Arbitrary File Delete | medium | 0.0 | 4% |