Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2745 | WordPress core | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthen | medium | 5.4 | 79% |
| CVE-2021-33618 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 79% |
| CVE-2022-25305 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter f | high | 7.2 | 79% |
| CVE-2021-24931 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_r | critical | 9.8 | 79% |
| CVE-2020-12800 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code ex | critical | 9.8 | 79% |
| CVE-2021-39312 | seo-local-rank (WordPress plugin) | The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be a | high | 7.5 | 78% |
| CVE-2024-1512 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via | critical | 9.8 | 78% |
| CVE-2024-1698 | notificationx (WordPress plugin) | The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulner | critical | 9.8 | 78% |
| CVE-2020-15148 | yiisoft/yii2 | Unsafe deserialization in Yii 2 | high | 8.9 | 78% |
| CVE-2022-25149 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter foun | critical | 9.8 | 77% |
| CVE-2019-10692 | wp-google-maps (WordPress plugin) | In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before | critical | 9.8 | 77% |
| CVE-2018-15877 | plainview-activity-monitor (WordPress plugin) | The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip | high | 8.8 | 77% |
| CVE-2024-5932 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | critical | 10.0 | 77% |
| CVE-2020-35951 | quiz-and-survey-master (WordPress plugin) | An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as w | critical | 9.9 | 76% |
| CVE-2014-9735 | showbiz-pro (WordPress plugin), slider-revolution (WordPress plugin) | The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does | high | 7.5 | 76% |
| CVE-2020-25540 | zoujingli/thinkadmin | ThinkAdmin directory traversal vulnerability | high | 7.5 | 75% |
| CVE-2021-3007 | laminas/laminas-http, zendframework/zendframework | Remote code execution in zendframework and laminas-http | critical | 9.8 | 75% |
| CVE-2022-0169 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using | critical | 9.8 | 75% |
| CVE-2015-6522 | wp-symposium (WordPress plugin) | SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands v | high | 7.5 | 74% |
| CVE-2022-0412 | ti-woocommerce-wishlist (WordPress plugin) | The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and e | critical | 9.8 | 74% |
| CVE-2024-49754 | librenms/librenms | LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php | high | 7.5 | 74% |
| CVE-2013-2010 | w3-total-cache (WordPress plugin), wp-super-cache (WordPress plugin) | WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability | critical | 9.8 | 74% |
| CVE-2023-6063 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, lea | high | 7.5 | 74% |
| CVE-2021-32610 | pear/archive_tar, drupal/core | Directory Traversal in Archive_Tar | high | 7.1 | 73% |
| CVE-2020-9757 | nystudio107/craft-seomatic | SEOmatic for CraftCMS allows Server-Side Template Injection | critical | 9.8 | 73% |
| CVE-2021-24946 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL state | critical | 9.8 | 73% |
| CVE-2021-24862 | registrationmagic (WordPress plugin) | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL | high | 7.2 | 73% |
| CVE-2018-6389 | WordPress core | In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of regist | high | 7.5 | 73% |
| CVE-2024-0637 | centreon/centreon | Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability | high | 8.8 | 72% |
| CVE-2023-3460 | ultimate-member (WordPress plugin) | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effecti | critical | 9.8 | 72% |
| CVE-2021-24917 | wps-hide-login (WordPress plugin) | The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and | high | 7.5 | 72% |
| CVE-2014-8684 | codeigniter/framework, kohana/core | CodeIgniter and Kohana vulnerable to PHP Object Injection | critical | 9.8 | 72% |
| CVE-2018-7251 | anchorcms/anchor-cms | Anchor CMS Logs Credentials | critical | 9.8 | 72% |
| CVE-2021-39327 | bulletproof-security (WordPress plugin) | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly ac | medium | 5.3 | 72% |
| CVE-2018-20434 | librenms/librenms | LibreNMS arbitrary OS commands execution | critical | 9.8 | 71% |
| CVE-2023-2034 | froxlor/froxlor | froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type | critical | 9.1 | 71% |
| CVE-2022-1386 | avada (WordPress plugin), fusion-builder (WordPress plugin) | The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to | critical | 9.8 | 71% |
| CVE-2019-19985 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user informat | medium | 5.3 | 71% |
| CVE-2024-4439 | WordPress core | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due t | high | 7.2 | 71% |
| CVE-2014-5460 | slideshow-gallery (WordPress plugin) | Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated user | medium | 6.5 | 71% |
| CVE-2021-32682 | studio-42/elfinder | elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE | critical | 9.8 | 70% |
| CVE-2018-10094 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability | critical | 9.8 | 70% |
| CVE-2023-4347 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | high | 7.6 | 70% |
| CVE-2022-0364 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which coul | medium | 5.4 | 70% |
| CVE-2022-34258 | magento/community-edition | Magento stored Cross-Site Scripting (XSS) vulnerability | medium | 5.5 | 69% |
| CVE-2019-10867 | pimcore/pimcore | Pimcore Unserialize Remote Code Execution | high | 8.8 | 69% |
| CVE-2021-34621 | profilepress (WordPress plugin) | A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin | critical | 9.8 | 69% |
| CVE-2023-6933 | better-search-replace (WordPress plugin) | The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deseria | high | 8.8 | 68% |
| CVE-2014-8799 | dukapress (WordPress plugin) | Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress a | medium | 5.0 | 68% |
| CVE-2024-23115 | centreon/centreon | Centreon updateGroups SQL Injection Remote Code Execution Vulnerability | high | 7.2 | 67% |