Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-10396 | epic (WordPress theme) | The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php. | high | 7.5 | 3% |
| CVE-2014-10397 | antioch (WordPress theme) | The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php. | high | 7.5 | 3% |
| CVE-2015-5609 | image-export (WordPress plugin) | Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary file | critical | 9.1 | 3% |
| CVE-2013-2107 | mail-on-update (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack th | medium | 6.8 | 3% |
| CVE-2018-19370 | wordpress-seo (WordPress plugin) | A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 | medium | 6.6 | 3% |
| CVE-2022-0377 | learnpress (WordPress plugin) | Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process th | medium | 4.3 | 3% |
| CVE-2016-6629 | phpmyadmin/phpmyadmin | phpMyAdmin Authentication Bypass | critical | 9.8 | 3% |
| CVE-2022-0954 | microweber/microweber | Stored Cross-site Scripting in Microweber | medium | 6.8 | 3% |
| CVE-2015-9269 | wordpress-mobile-pack (WordPress plugin) | The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attacke | high | 7.5 | 3% |
| CVE-2019-16120 | event-tickets (WordPress plugin) | CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Expo | high | 8.8 | 3% |
| CVE-2023-35169 | webklex/laravel-imap, webklex/php-imap | php-imap vulnerable to RCE through a directory traversal vulnerability | critical | 9.0 | 3% |
| CVE-2016-3171 | drupal/core, drupal/drupal | Drupal arbitrary code execution | high | 8.1 | 3% |
| CVE-2017-14125 | responsive-image-gallery-gallery-album (WordPress plugin) | SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary S | critical | 9.8 | 3% |
| CVE-2017-1002005 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before | high | 7.5 | 3% |
| CVE-2015-2194 | fusion (WordPress theme) | Unrestricted file upload vulnerability in the fusion_options function in functions.php in the Fusion theme 3.1 for Wordpress allows remote a | medium | 6.5 | 3% |
| CVE-2021-33829 | drupal/core, drupal/drupal | **Update: 2021-06-11: Added CVE-2021-33829 identifier** Drupal core uses the third-party CKEditor library. This library | medium | 6.1 | 3% |
| CVE-2012-6692 | wordpress-seo (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote | medium | 4.3 | 3% |
| CVE-2013-1400 | wordpress-poll (WordPress plugin) | Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL co | critical | 9.8 | 3% |
| CVE-2021-29460 | getkirby/cms | Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby | high | 7.6 | 3% |
| CVE-2022-39261 | twig/twig, drupal/core | Twig may load a template outside a configured directory when using the filesystem loader | high | 7.5 | 3% |
| CVE-2012-3521 | geshi/geshi | GeSHi vulnerable to Directory Traversal | high | 0.0 | 3% |
| CVE-2019-20209 | citybook (WordPress plugin), easybook (WordPress plugin), townhub (WordPress plugin) | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Refere | high | 7.5 | 3% |
| CVE-2011-0701 | WordPress core | wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) p | medium | 4.0 | 3% |
| CVE-2015-5599 | powerplay-gallery (WordPress plugin) | Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arb | high | 7.5 | 3% |
| CVE-2020-3719 | magento/community-edition, magento/core | Magento sql injection vulnerability | high | 7.5 | 3% |
| CVE-2020-3717 | magento/community-edition | Magento Path Traversal | medium | 5.3 | 3% |
| CVE-2011-4957 | WordPress core | The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the | medium | 5.0 | 3% |
| CVE-2013-5977 | cart66-lite (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote a | medium | 6.8 | 3% |
| CVE-2024-1207 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in | critical | 9.8 | 3% |
| CVE-2023-5974 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter. | critical | 9.8 | 3% |
| CVE-2019-14328 | simple-membership (WordPress plugin) | The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. | high | 8.8 | 3% |
| CVE-2022-2130 | microweber/microweber | Cross-site Scripting in Microweber | medium | 6.1 | 3% |
| CVE-2023-47130 | yiisoft/yii | yiisoft/yii deserializing untrusted user input can lead to remote code execution | high | 8.1 | 3% |
| CVE-2005-1810 | WordPress core | SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands | high | 7.5 | 3% |
| CVE-2010-4257 | WordPress core | SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated u | medium | 6.0 | 3% |
| CVE-2019-9912 | wp-go-maps (WordPress plugin) | The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO. | medium | 6.1 | 3% |
| CVE-2014-5265 | WordPress core | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarat | medium | 5.0 | 3% |
| CVE-2013-0237 | WordPress core | Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other prod | medium | 4.3 | 3% |
| CVE-2021-24884 | formidable-form-builder (WordPress plugin) | The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.Th | critical | 9.6 | 3% |
| CVE-2020-36728 | adning-advertising (WordPress plugin) | The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This | medium | 6.5 | 3% |
| CVE-2014-8350 | smarty/smarty | Smarty arbitrary PHP code execution | high | 0.0 | 3% |
| CVE-2017-1000480 | smarty/smarty | Smarty PHP code injection | critical | 9.8 | 3% |
| CVE-2021-36033 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the Widgets Module | critical | 0.0 | 3% |
| CVE-2013-1842 | typo3/cms-core | TYPO3 SQL injection vulnerability in the Extbase Framework | high | 7.4 | 3% |
| CVE-2018-14059 | pimcore/pimcore | Pimcore XSS Vulnerability | medium | 5.4 | 3% |
| CVE-2019-7846 | magento/product-community-edition | PRODSECBUG-1513: Insufficient brute force protections on promo code entry | unknown | 0.0 | 3% |
| CVE-2015-7670 | simple-support-ticket-system (WordPress plugin) | Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote at | critical | 9.8 | 3% |
| CVE-2021-36031 | magento/community-edition, magento/project-community-edition | Magento Path Traversal vulnerability via the `theme[preview_image]` parameter | high | 0.0 | 3% |
| CVE-2016-10131 | bcit-ci/codeigniter | CodeIgniter arbitrary code execution | critical | 9.8 | 3% |
| CVE-2008-0615 | dmsguestbook (WordPress plugin) | Directory traversal vulnerability in wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allows remote authenticated | medium | 4.0 | 3% |