Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2008-0195 | WordPress core | WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP | medium | 5.0 | 3% |
| CVE-2005-4463 | WordPress core | WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-cont | medium | 5.0 | 3% |
| CVE-2009-0258 | typo3/cms | Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection | high | 0.0 | 3% |
| CVE-2019-13478 | yoast-seo (WordPress plugin) | The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions. | critical | 9.8 | 3% |
| CVE-2020-9371 | appointment-booking-calendar (WordPress plugin) | Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar N | medium | 4.8 | 3% |
| CVE-2024-0566 | smart-manager (WordPress plugin) | The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leadi | high | 7.2 | 3% |
| CVE-2018-14057 | pimcore/pimcore | Pimcore CSRF Vulnerability | high | 8.8 | 3% |
| CVE-2024-6924 | truebooker (WordPress plugin) | The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJ | critical | 9.8 | 3% |
| CVE-2024-6926 | viral-signup (WordPress plugin) | The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an A | critical | 9.8 | 3% |
| CVE-2024-6928 | opti-marketing (WordPress plugin) | The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a | critical | 9.8 | 3% |
| CVE-2024-9193 | whmcs (WordPress plugin) | The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl | critical | 9.8 | 3% |
| CVE-2014-6059 | advanced-access-manager (WordPress plugin) | WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability | high | 7.2 | 3% |
| CVE-2014-2559 | twitget (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote atta | medium | 6.8 | 3% |
| CVE-2024-35242 | composer/composer | Composer has multiple command injections via malicious git/hg branch names | high | 8.8 | 3% |
| CVE-2006-0986 | WordPress core | WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) tem | medium | 5.0 | 3% |
| CVE-2007-6013 | WordPress core | Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication | critical | 9.8 | 3% |
| CVE-2012-1936 | WordPress core | The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a | medium | 6.8 | 3% |
| CVE-2020-4047 | WordPress core | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media | medium | 6.8 | 3% |
| CVE-2021-21025 | magento/community-edition, magento/project-community-edition | Magento XPath Injection | critical | 9.1 | 3% |
| CVE-2019-8159 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 3% |
| CVE-2015-5472 | ibs-mappro (WordPress plugin) | Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read | high | 7.8 | 3% |
| CVE-2022-0967 | showdoc/showdoc | Stored Cross-site Scripting in showdoc | medium | 6.9 | 3% |
| CVE-2007-0109 | WordPress core | wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obta | medium | 5.0 | 3% |
| CVE-2015-2269 | moodle/moodle | Moodle XSS Vulnerability | low | 0.0 | 3% |
| CVE-2022-1439 | microweber/microweber | Cross-site Scripting in Microweber | medium | 6.3 | 3% |
| CVE-2012-6512 | organizer (WordPress plugin) | The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to (1) plugin_hook. | medium | 5.0 | 3% |
| CVE-2021-24308 | lifterlms (WordPress plugin) | The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordP | medium | 5.4 | 3% |
| CVE-2019-17234 | igniteup (WordPress plugin) | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion. | high | 7.5 | 3% |
| CVE-2019-20210 | citybook (WordPress plugin), easybook (WordPress plugin), townhub (WordPress plugin) | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search q | medium | 6.1 | 3% |
| CVE-2022-0683 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization | medium | 6.1 | 3% |
| CVE-2016-7169 | WordPress core | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade packa | medium | 6.3 | 3% |
| CVE-2021-26601 | impresscms/impresscms | Path Traversal in ImpressCMS | high | 8.1 | 3% |
| CVE-2016-1000129 | defa-online-image-protector (WordPress plugin) | Reflected XSS in wordpress plugin defa-online-image-protector v3.3 | medium | 6.1 | 3% |
| CVE-2021-22968 | concrete5/core | Improper file handling in concrete5/core | high | 7.2 | 3% |
| CVE-2008-5278 | WordPress core | Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before | medium | 4.3 | 3% |
| CVE-2017-1002006 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecti | high | 7.5 | 3% |
| CVE-2017-1002007 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting | high | 7.5 | 3% |
| CVE-2014-8375 | gb-gallery-slideshow (WordPress plugin) | SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute ar | medium | 6.5 | 3% |
| CVE-2023-0900 | pricing-table-builder (WordPress plugin) | The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statemen | high | 7.2 | 3% |
| CVE-2023-1408 | video-list-manager (WordPress plugin) | The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, le | high | 7.2 | 3% |
| CVE-2021-27817 | shopxo/shopxo | ShopXO RCE Vulnerability | critical | 9.8 | 3% |
| CVE-2017-5491 | WordPress core | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with th | medium | 5.3 | 3% |
| CVE-2020-14044 | codiad/codiad | Codiad SSRF Vulnerability | high | 7.2 | 3% |
| CVE-2021-24174 | database-backups (WordPress plugin) | The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted action | high | 8.1 | 3% |
| CVE-2012-6651 | vitamin (WordPress plugin) | Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary fil | medium | 5.0 | 3% |
| CVE-2018-6015 | email-subscribers (WordPress plugin) | An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI wi | high | 7.5 | 3% |
| CVE-2019-1010124 | woocommerce-product-feed (WordPress plugin) | WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing them | medium | 5.4 | 3% |
| CVE-2019-15819 | nd-restaurant-reservations (WordPress plugin) | The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication. | critical | 9.8 | 3% |
| CVE-2020-11511 | learnpress (WordPress plugin) | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the a | high | 8.1 | 3% |
| CVE-2016-1000148 | s3-video (WordPress plugin) | Reflected XSS in wordpress plugin s3-video v0.983 | medium | 6.1 | 3% |