Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-13982 | smarty/smarty | Smarty Path Traversal Vulnerability | high | 7.5 | 3% |
| CVE-2014-3114 | ezpz-one-click-backup (WordPress plugin) | The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary com | critical | 9.8 | 3% |
| CVE-2022-2379 | easy-student-results (WordPress plugin) | The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve info | high | 7.5 | 3% |
| CVE-2016-1000141 | page-layout-builder (WordPress plugin) | Reflected XSS in wordpress plugin page-layout-builder v1.9.3 | medium | 6.1 | 3% |
| CVE-2016-1000146 | pondol-formmail (WordPress plugin) | Reflected XSS in wordpress plugin pondol-formmail v1.1 | medium | 6.1 | 3% |
| CVE-2020-7108 | learndash (WordPress plugin) | The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field. | medium | 5.4 | 3% |
| CVE-2010-4536 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary w | medium | 4.3 | 3% |
| CVE-2021-36022 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the Widgets Update Layout | high | 7.2 | 3% |
| CVE-2017-1002012 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snipp | critical | 9.8 | 3% |
| CVE-2022-3590 | WordPress core | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation ch | medium | 5.9 | 3% |
| CVE-2016-1000138 | indexisto (WordPress plugin) | Reflected XSS in wordpress plugin indexisto v1.0.5 | medium | 6.1 | 3% |
| CVE-2016-1000140 | new-year-firework (WordPress plugin) | Reflected XSS in wordpress plugin new-year-firework v1.1.9 | medium | 6.1 | 3% |
| CVE-2016-1000154 | whizz (WordPress plugin) | Reflected XSS in wordpress plugin whizz v1.0.7 | medium | 6.1 | 3% |
| CVE-2021-40219 | bolt/core | Code Injection in Bolt CMS | high | 8.8 | 3% |
| CVE-2020-9591 | magento/community-edition, magento/core | Magento defense-in-depth security mitigation vulnerability | high | 7.5 | 3% |
| CVE-2008-0196 | WordPress core | Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot do | medium | 5.0 | 3% |
| CVE-2017-17059 | amtythumb (WordPress plugin) | XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to | medium | 6.1 | 3% |
| CVE-2016-1000133 | forget-about-shortcode-buttons (WordPress plugin) | Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1 | medium | 6.1 | 3% |
| CVE-2016-1000136 | heat-trackr (WordPress plugin) | Reflected XSS in wordpress plugin heat-trackr v1.0 | medium | 6.1 | 3% |
| CVE-2022-4953 | website-builder (WordPress plugin) | The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This co | medium | 6.1 | 3% |
| CVE-2017-1002004 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before addin | high | 7.5 | 3% |
| CVE-2015-9415 | bj-lazy-load (WordPress plugin) | The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion. | high | 7.5 | 3% |
| CVE-2015-7809 | twig/twig | Twig remote code execution in templates | high | 8.1 | 3% |
| CVE-2015-7564 | nilsteampassnet/teampass | TeamPass vulnerable to SQL Injection | critical | 9.8 | 3% |
| CVE-2016-5091 | typo3/cms-extbase | Extbase for TYPO3 allows RCE | high | 8.1 | 3% |
| CVE-2012-2401 | WordPress core | Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the | medium | 5.0 | 3% |
| CVE-2022-0692 | rudloff/alltube | Open Redirect in AllTube | medium | 6.1 | 3% |
| CVE-2019-20204 | postie (WordPress plugin) | The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SV | medium | 5.4 | 3% |
| CVE-2021-24148 | mstore-api (WordPress plugin) | A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allow | critical | 9.8 | 3% |
| CVE-2013-2173 | WordPress core | wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service | medium | 4.3 | 3% |
| CVE-2022-0201 | permalink-manager (WordPress plugin), permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escap | medium | 6.1 | 3% |
| CVE-2015-3986 | thecartpress (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin | medium | 4.3 | 3% |
| CVE-2022-0246 | iq-block-country (WordPress plugin) | The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorize | medium | 4.9 | 3% |
| CVE-2018-17573 | wp-insert (WordPress plugin) | The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor | critical | 9.8 | 3% |
| CVE-2022-41978 | zoho-crm-forms (WordPress plugin) | Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress. | high | 8.8 | 3% |
| CVE-2015-5731 | WordPress core | Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authent | medium | 6.8 | 3% |
| CVE-2019-11325 | symfony/symfony, symfony/var-exporter | Improper Input Validation in Symfony | critical | 9.8 | 3% |
| CVE-2019-15822 | wps-child-theme-generator (WordPress plugin) | The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal. | critical | 9.8 | 3% |
| CVE-2018-7543 | duplicator (WordPress plugin) | Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows re | medium | 6.1 | 3% |
| CVE-2022-33198 | accordions-or-faqs (WordPress plugin) | Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress. | critical | 9.8 | 3% |
| CVE-2022-34487 | shortcode-addons (WordPress plugin) | Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress. | critical | 9.8 | 3% |
| CVE-2024-4620 | arforms (WordPress plugin) | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in suc | critical | 9.8 | 3% |
| CVE-2025-1562 | wp-marketing-automations (WordPress plugin) | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable | critical | 9.8 | 3% |
| CVE-2021-24495 | marmoset-viewer (WordPress plugin) | The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back i | medium | 6.1 | 3% |
| CVE-2019-16931 | visualizer (WordPress plugin) | A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript w | medium | 6.1 | 3% |
| CVE-2019-12468 | mediawiki/core | Wikimedia MediaWiki Incorrect Access Control vulnerability | critical | 9.8 | 3% |
| CVE-2017-11658 | wp-rocket (WordPress plugin) | In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, | high | 7.5 | 3% |
| CVE-2015-3173 | custom-content-type-manager (WordPress plugin) | custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution. | high | 7.2 | 3% |
| CVE-2023-0232 | woolentor-addons (WordPress plugin) | The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which cou | critical | 9.8 | 3% |
| CVE-2023-5991 | hotel-booking-lite (WordPress plugin) | The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper C | critical | 9.8 | 3% |