Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9487 | almera-responsive-portfolio (WordPress theme) | The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information ( | high | 7.5 | 3% |
| CVE-2015-9488 | almera-responsive-portfolio-site-template (WordPress plugin) | The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensi | high | 7.5 | 3% |
| CVE-2015-9489 | goodnex-premium-responsive (WordPress theme) | The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s | high | 7.5 | 3% |
| CVE-2015-9490 | gamestheme-premium (WordPress theme) | The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as u | high | 7.5 | 3% |
| CVE-2015-9491 | blessing-premium-responsive (WordPress theme) | The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information ( | high | 7.5 | 3% |
| CVE-2015-9492 | smartit-premium-responsive (WordPress theme) | The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s | high | 7.5 | 3% |
| CVE-2018-14071 | geo-mashup (WordPress plugin) | The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input. | critical | 9.8 | 3% |
| CVE-2017-6514 | WordPress core | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a / | medium | 5.3 | 3% |
| CVE-2015-0902 | all-in-one-seo-pack (WordPress plugin) | The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation | medium | 5.0 | 3% |
| CVE-2020-10738 | moodle/moodle | Moodle vulnerable to RCE | high | 8.8 | 3% |
| CVE-2016-5739 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-Site Request Forgery | high | 7.5 | 3% |
| CVE-2020-9588 | magento/community-edition, magento/core, magento/project-community-edition | Magento Signature verification bypass | high | 7.2 | 3% |
| CVE-2013-2204 | WordPress core | moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider | medium | 4.3 | 3% |
| CVE-2022-1595 | hc-custom-wp-admin-url (WordPress plugin) | The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request | medium | 5.3 | 3% |
| CVE-2018-19968 | phpmyadmin/phpmyadmin | phpMyAdmin Local file inclusion through transformation feature | medium | 6.5 | 3% |
| CVE-2009-2431 | WordPress core | WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by | medium | 5.0 | 3% |
| CVE-2021-36040 | magento/community-edition, magento/project-community-edition | Magento has a file extension restrictions bypass | critical | 9.1 | 3% |
| CVE-2016-4825 | welcart-e-commerce (WordPress plugin) | The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute | medium | 5.6 | 3% |
| CVE-2017-6815 | WordPress core | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. | medium | 6.1 | 3% |
| CVE-2021-36025 | magento/community-edition, magento/project-community-edition | Magento is affected by an improper input validation vulnerability while saving a customer's details | critical | 9.1 | 3% |
| CVE-2015-9351 | feed-them-social (WordPress plugin) | The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button. | critical | 9.8 | 3% |
| CVE-2012-5868 | WordPress core | WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote a | low | 2.6 | 3% |
| CVE-2014-10383 | memphis-documents-library (WordPress plugin) | The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion. | critical | 9.8 | 3% |
| CVE-2014-3941 | typo3/cms | Typo3 Host Header Spoofing Vulnerability | medium | 0.0 | 3% |
| CVE-2015-7873 | phpmyadmin/phpmyadmin | phpMyAdmin allows remote attackers to spoof content via the url parameter | high | 0.0 | 3% |
| CVE-2016-5730 | phpmyadmin/phpmyadmin | phpMyAdmin full path disclosure vulnerability | medium | 5.3 | 3% |
| CVE-2014-8336 | wp-dbmanager (WordPress plugin) | The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary | medium | 6.5 | 3% |
| CVE-2016-2041 | phpmyadmin/phpmyadmin | phpMyAdmin Unsafe comparison of XSRF/CSRF token | high | 7.5 | 3% |
| CVE-2008-0191 | WordPress core | WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the defaul | medium | 5.0 | 3% |
| CVE-2014-9177 | html5-mp3-player-with-playlist (WordPress plugin) | The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a reques | medium | 5.0 | 3% |
| CVE-2015-8125 | symfony/form, symfony/security, symfony/security-http +1 more | Symfony Vulnerable to Timing Attack | high | 0.0 | 3% |
| CVE-2016-9853 | phpmyadmin/phpmyadmin | phpMyAdmin path disclosure | medium | 5.3 | 3% |
| CVE-2011-3818 | WordPress core | WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the ins | medium | 5.0 | 3% |
| CVE-2019-7412 | ps-phpcaptcha (WordPress plugin) | The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values. | critical | 9.8 | 3% |
| CVE-2016-6565 | nextgen-gallery (WordPress plugin) | The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a | high | 7.5 | 3% |
| CVE-2022-24775 | guzzlehttp/psr7, drupal/core | Improper Input Validation in guzzlehttp/psr7 | medium | 5.3 | 2% |
| CVE-2021-36042 | magento/community-edition, magento/project-community-edition | Magento executes code via the API File Option Upload Extension | critical | 9.1 | 2% |
| CVE-2011-3128 | WordPress core | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain se | medium | 5.0 | 2% |
| CVE-2014-10076 | wp-db-backup (WordPress plugin) | The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers | high | 7.5 | 2% |
| CVE-2014-6230 | wp-ban (WordPress plugin) | WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a c | medium | 4.3 | 2% |
| CVE-2019-16699 | sjbr/sr-freecap | sr_freecap for Typo3 RCE Vulnerability | critical | 9.8 | 2% |
| CVE-2021-36034 | magento/community-edition, magento/project-community-edition | Magento affected by remote code execution via a file upload | high | 7.2 | 2% |
| CVE-2021-36041 | magento/community-edition, magento/project-community-edition | Magento vulnerable to file upload attack | high | 7.2 | 2% |
| CVE-2024-1209 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via dire | medium | 5.3 | 2% |
| CVE-2021-3943 | moodle/moodle | Moodle vulnerable to RCE via unsafe deserialization | critical | 9.8 | 2% |
| CVE-2018-1999009 | october/october | October CMS Local File Inclusion | high | 8.1 | 2% |
| CVE-2015-5267 | moodle/moodle | Moodle uses predictable password-recovery tokens | high | 7.5 | 2% |
| CVE-2024-12008 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the public | medium | 5.3 | 2% |
| CVE-2017-12869 | simplesamlphp/simplesamlphp | SimpleSAMLphp Authentication context bypass in the multiauth module | high | 7.5 | 2% |
| CVE-2013-5738 | WordPress core | The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability f | medium | 4.3 | 2% |