Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-7932 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2023-34251 | getgrav/grav | Grav Server Side Template Injection (SSTI) vulnerability | critical | 9.1 | 2% |
| CVE-2014-3947 | in2code/powermail | TYPO3 powermail extension has unrestricted file upload vulnerability | high | 0.0 | 2% |
| CVE-2015-4338 | xcloner (WordPress plugin) | Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code | medium | 6.5 | 2% |
| CVE-2024-13346 | avada (WordPress theme) | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions u | high | 7.3 | 2% |
| CVE-2022-39365 | pimcore/pimcore | RCE vulnerability in Pimcore/Mail & Dynamic Text Layout | critical | 9.8 | 2% |
| CVE-2023-5540 | moodle/moodle | Moodle Code Injection vulnerability | high | 8.8 | 2% |
| CVE-2019-11201 | dolibarr/dolibarr | Dolibarr ERP and CRM Code Injection | high | 8.0 | 2% |
| CVE-2023-5539 | moodle/moodle | Moodle Code Injection vulnerability | medium | 4.7 | 2% |
| CVE-2023-5843 | ads-by-datafeedrcom (WordPress plugin) | The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ | critical | 9.0 | 2% |
| CVE-2019-15318 | yikes-inc-easy-mailchimp-extender (WordPress plugin) | The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field. | critical | 9.8 | 2% |
| CVE-2019-7903 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2014-4672 | yiisoft/yii | Yii PHP Framework arbitrary PHP scripts execution | high | 0.0 | 2% |
| CVE-2022-40314 | moodle/moodle | Moodle remote code execution | critical | 9.8 | 2% |
| CVE-2015-9298 | events-manager (WordPress plugin) | The events-manager plugin before 5.6 for WordPress has code injection. | critical | 9.8 | 2% |
| CVE-2021-32650 | october/system | october/system arbitrary code execution | high | 8.8 | 2% |
| CVE-2023-34252 | getgrav/grav | Grav Server-side Template Injection (SSTI) via Twig Default Filters | high | 7.2 | 2% |
| CVE-2023-34253 | getgrav/grav | Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability | high | 7.2 | 2% |
| CVE-2018-21005 | bbp-move-topics (WordPress plugin) | The bbp-move-topics plugin before 1.1.6 for WordPress has code injection. | critical | 9.8 | 2% |
| CVE-2023-2017 | shopware/core, shopware/platform | Shopware Has Improper Control of Generation of Code in Twig rendered views | high | 8.8 | 2% |
| CVE-2022-24663 | php-everywhere (WordPress plugin) | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by an | critical | 9.9 | 2% |
| CVE-2017-5543 | intelliants/subrion | Subrion CMS PHP Object Injection | critical | 9.8 | 2% |
| CVE-2023-5762 | filr (WordPress plugin) | The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system | high | 8.8 | 2% |
| CVE-2022-3394 | wp-all-export (WordPress plugin) | The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator ro | high | 7.2 | 2% |
| CVE-2024-22188 | typo3/cms-core | TYPO3 Install Tool vulnerable to Code Execution | high | 7.2 | 2% |
| CVE-2025-3472 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due | medium | 6.5 | 2% |
| CVE-2023-5604 | asgaros-forum (WordPress plugin) | The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecur | critical | 9.8 | 2% |
| CVE-2022-41705 | badaso/core | Badaso vulnerable to Remote Code Execution (RCE) | critical | 9.8 | 2% |
| CVE-2017-18356 | woocommerce (WordPress plugin) | In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user a | high | 8.8 | 2% |
| CVE-2021-24312 | wp-super-cache (WordPress plugin) | The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the set | high | 7.2 | 2% |
| CVE-2021-4434 | social-warfare (WordPress plugin) | The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' par | critical | 10.0 | 2% |
| CVE-2019-7942 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE | high | 7.2 | 2% |
| CVE-2022-24828 | composer/composer | Missing input validation can lead to command execution in composer | high | 8.3 | 2% |
| CVE-2024-11740 | download-manager (WordPress plugin) | The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. T | high | 7.3 | 2% |
| CVE-2010-4962 | dmk/webkitpdf | Webkit PDFs for TYPO3 allows remote attackers to execute arbitrary commands | high | 0.0 | 2% |
| CVE-2011-4943 | impresspages/impresspages | ImpressPages CMS RCE | critical | 9.8 | 2% |
| CVE-2021-24546 | editorskit (WordPress plugin) | The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the C | high | 8.8 | 2% |
| CVE-2024-47051 | mautic/core | Mautic allows Remote Code Execution and File Deletion in Asset Uploads | critical | 9.1 | 2% |
| CVE-2022-21686 | prestashop/prestashop | Server Side Twig Template Injection | critical | 9.0 | 2% |
| CVE-2022-0895 | microweber/microweber | Static Code Injection in Microweber | high | 7.7 | 2% |
| CVE-2014-2558 | file-gallery (WordPress plugin) | The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitra | medium | 6.5 | 2% |
| CVE-2022-25812 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high priv | high | 7.2 | 2% |
| CVE-2014-5324 | n-media-file-uploader (WordPress plugin) | Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to exe | medium | 6.5 | 2% |
| CVE-2021-24430 | speed-booster-pack (WordPress plugin) | The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_in | high | 7.2 | 2% |
| CVE-2014-3545 | moodle/moodle | Moodle remote code execution via quiz questions | medium | 0.0 | 2% |
| CVE-2018-25357 | dolibarr/dolibarr | Dolibarr ERP CRM contains a remote code evaluation vulnerability | critical | 9.8 | 2% |
| CVE-2012-0796 | phpmailer/phpmailer | PHPMailer vulnerable to email header injection | high | 0.0 | 2% |
| CVE-2022-24664 | php-everywhere (WordPress plugin) | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by a | critical | 9.9 | 2% |
| CVE-2023-2859 | nilsteampassnet/teampass | Code injection in nilsteampassnet/teampass | high | 7.1 | 2% |
| CVE-2017-16871 | updraftplus (WordPress plugin) | The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/pl | high | 8.1 | 2% |