Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-9844 | wp-file-upload (WordPress plugin) | The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. | medium | 6.1 | 4% |
| CVE-2007-4894 | WordPress core | Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execu | high | 7.5 | 4% |
| CVE-2021-21019 | magento/community-edition | Magento XML injection in the Widgets module | critical | 9.1 | 4% |
| CVE-2019-15324 | ad-inserter (WordPress plugin) | The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. | high | 8.8 | 4% |
| CVE-2022-4297 | wp-autocomplete-search (WordPress plugin) | The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an | critical | 9.8 | 4% |
| CVE-2017-1002020 | surveys (WordPress plugin) | Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it insid | critical | 9.8 | 4% |
| CVE-2017-1002021 | surveys (WordPress plugin) | Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before plac | critical | 9.8 | 4% |
| CVE-2017-1002022 | surveys (WordPress plugin) | Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside | critical | 9.8 | 4% |
| CVE-2015-10144 | thumbnail-carousel-slider (WordPress plugin) | The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the vi | high | 8.8 | 4% |
| CVE-2025-8671 | amphp/http-server | Denial of Service via "MadeYouReset" vulnerability | unknown | 0.0 | 4% |
| CVE-2011-4280 | moodle/moodle | Moodle vulnerable to XSS via bundled spikephpcoverage library | medium | 0.0 | 4% |
| CVE-2020-12054 | catch-breadcrumb (WordPress plugin) | The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 theme | medium | 6.1 | 4% |
| CVE-2014-8810 | wp-symposium (WordPress plugin) | SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated use | medium | 6.5 | 4% |
| CVE-2014-9305 | cart66-lite (WordPress plugin) | SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordP | medium | 6.5 | 4% |
| CVE-2015-9414 | wp-symposium (WordPress plugin) | The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter. | medium | 6.1 | 4% |
| CVE-2021-41467 | hjue/justwriting | Cross-site scripting in application/controllers/dropbox.php in JustWriting | medium | 6.1 | 4% |
| CVE-2018-20152 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. | medium | 6.5 | 4% |
| CVE-2018-16974 | elefant/cms | Elefant CMS Code Execution Vulnerability | critical | 9.8 | 4% |
| CVE-2023-4490 | wp-job-portal (WordPress plugin) | The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQ | critical | 9.8 | 4% |
| CVE-2022-0901 | ad-inserter (WordPress plugin) | The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admi | medium | 6.1 | 4% |
| CVE-2018-19789 | symfony/form, symfony/symfony | Symfony Path Disclosure | medium | 5.3 | 4% |
| CVE-2007-0539 | WordPress core | The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) | high | 7.8 | 4% |
| CVE-2006-5705 | WordPress core | Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read | medium | 6.0 | 4% |
| CVE-2014-2995 | twitget (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticat | low | 3.5 | 4% |
| CVE-2019-6798 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection in Designer feature | critical | 9.8 | 4% |
| CVE-2023-23924 | dompdf/dompdf | Dompdf vulnerable to URI validation failure on SVG parsing | critical | 10.0 | 4% |
| CVE-2022-2711 | wp-all-import (WordPress plugin) | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, all | high | 7.2 | 4% |
| CVE-2020-11928 | media-library-assistant (WordPress plugin) | In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_quer | critical | 9.8 | 4% |
| CVE-2016-1000143 | photoxhibit (WordPress plugin) | Reflected XSS in wordpress plugin photoxhibit v2.1.8 | medium | 6.1 | 4% |
| CVE-2020-15086 | friendsoftypo3/mediace | Potential Remote Code Execution in TYPO3 with mediace extension | critical | 9.8 | 4% |
| CVE-2014-4944 | bsk-pdf-manager (WordPress plugin) | Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authentic | medium | 6.5 | 4% |
| CVE-2008-0664 | WordPress core | The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of ot | medium | 6.4 | 4% |
| CVE-2019-11768 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection in Designer feature | critical | 9.8 | 4% |
| CVE-2018-11709 | wpforo (WordPress plugin) | wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected | medium | 6.1 | 4% |
| CVE-2012-0782 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlie | medium | 4.3 | 4% |
| CVE-2024-6244 | pz-frontend-manager (WordPress plugin) | The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged i | high | 8.8 | 4% |
| CVE-2021-24498 | calendar-event-multi-view (WordPress plugin) | The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputt | medium | 6.1 | 4% |
| CVE-2019-17673 | WordPress core | WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header. | high | 7.5 | 4% |
| CVE-2020-11673 | poll-wp (WordPress plugin) | An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., del | critical | 9.8 | 4% |
| CVE-2021-24217 | facebook (WordPress plugin) | The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects | high | 8.1 | 4% |
| CVE-2019-17232 | ultimate-faqs (WordPress plugin) | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. | high | 7.5 | 4% |
| CVE-2014-5014 | wordpress-flash-uploader (WordPress plugin) | The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to | critical | 9.8 | 4% |
| CVE-2017-15054 | nilsteampassnet/teampass | TeamPass arbitrary file upload vulnerability | high | 7.5 | 3% |
| CVE-2014-9179 | supportezzy-ticket-system (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to in | medium | 4.0 | 3% |
| CVE-2015-3634 | slideshow-jquery-image-gallery (WordPress plugin) | The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remo | high | 7.5 | 3% |
| CVE-2021-32708 | league/flysystem | Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem | critical | 9.8 | 3% |
| CVE-2017-17092 | WordPress core | wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might all | medium | 5.4 | 3% |
| CVE-2014-8334 | wp-dbmanager (WordPress plugin) | The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands vi | medium | 6.5 | 3% |
| CVE-2014-2598 | quick-pagepost-redirect-plugin (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to | medium | 6.8 | 3% |
| CVE-2018-19933 | bolt/bolt | Bolt Cross-site Scripting (XSS) via text input click preview button | medium | 6.1 | 3% |