Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1751 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id para | high | 8.8 | 3% |
| CVE-2018-20147 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. | medium | 6.5 | 3% |
| CVE-2018-11564 | pagekit/pagekit | Pagekit Stored Cross-site Scripting | medium | 4.8 | 3% |
| CVE-2012-3383 | WordPress core | The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not p | low | 2.6 | 3% |
| CVE-2020-36326 | phpmailer/phpmailer | Object injection in PHPMailer/PHPMailer | critical | 9.8 | 3% |
| CVE-2006-0985 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attacker | medium | 4.3 | 3% |
| CVE-2012-1607 | typo3/cms | TYPO3 allows remote attackers to obtain the database name via a direct request | medium | 0.0 | 3% |
| CVE-2022-1153 | layerslider (WordPress plugin) | The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which | medium | 4.8 | 3% |
| CVE-2023-24788 | notrinos/notrinos-erp | NotrinosERP vulnerable to SQL Injection | high | 8.8 | 3% |
| CVE-2007-3239 | WordPress core | Cross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to in | medium | 4.3 | 3% |
| CVE-2010-5099 | typo3/cms | TYPO3 Path Traversal vulnerability | medium | 0.0 | 3% |
| CVE-2003-1599 | WordPress core | PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code vi | high | 7.5 | 3% |
| CVE-2024-8943 | latepoint (WordPress plugin) | The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insuffic | critical | 9.8 | 3% |
| CVE-2009-2432 | WordPress core | WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, whic | medium | 5.0 | 3% |
| CVE-2022-44289 | topthink/framework | Thinkphp has a code logic error | high | 8.8 | 3% |
| CVE-2018-9172 | wp-file-upload (WordPress plugin) | The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. | medium | 5.4 | 3% |
| CVE-2021-24210 | phastpress (WordPress plugin) | There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the pl | medium | 6.1 | 3% |
| CVE-2015-9481 | diplomat-\|-political (WordPress theme) | The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as | high | 7.5 | 3% |
| CVE-2015-9482 | car-dealer-\/-auto-dealer-responsive (WordPress theme) | The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive infor | high | 7.5 | 3% |
| CVE-2015-9483 | invento-\/-architecture-building-agency-template (WordPress plugin) | The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtai | high | 7.5 | 3% |
| CVE-2015-9484 | accio-one-page-parallax-responsive-theme (WordPress theme) | The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive inform | high | 7.5 | 3% |
| CVE-2015-9485 | accio-responsive-onepage-parallax-site-template (WordPress plugin) | The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtai | high | 7.5 | 3% |
| CVE-2015-9486 | axioma-premium-responsive (WordPress theme) | The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (su | high | 7.5 | 3% |
| CVE-2015-9487 | almera-responsive-portfolio (WordPress theme) | The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information ( | high | 7.5 | 3% |
| CVE-2015-9488 | almera-responsive-portfolio-site-template (WordPress plugin) | The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensi | high | 7.5 | 3% |
| CVE-2015-9489 | goodnex-premium-responsive (WordPress theme) | The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s | high | 7.5 | 3% |
| CVE-2015-9490 | gamestheme-premium (WordPress theme) | The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as u | high | 7.5 | 3% |
| CVE-2015-9491 | blessing-premium-responsive (WordPress theme) | The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information ( | high | 7.5 | 3% |
| CVE-2015-9492 | smartit-premium-responsive (WordPress theme) | The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s | high | 7.5 | 3% |
| CVE-2015-10143 | platform-theme (WordPress theme) | The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing c | critical | 9.8 | 3% |
| CVE-2021-24947 | responsive-vector-maps (WordPress plugin) | The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path par | medium | 6.5 | 3% |
| CVE-2022-0953 | download-anti-malware-security-and-brute-force-firewall (WordPress plugin) | The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outp | medium | 6.1 | 3% |
| CVE-2011-2687 | drupal/core | Drupal Access Control Bypass | high | 0.0 | 3% |
| CVE-2018-14071 | geo-mashup (WordPress plugin) | The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input. | critical | 9.8 | 3% |
| CVE-2018-6521 | simplesamlphp/simplesamlphp | SimpleSAMLphp Use of insecure connection charset (sqlauth module) | critical | 9.8 | 3% |
| CVE-2017-6816 | WordPress core | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. | medium | 4.9 | 3% |
| CVE-2022-3383 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_v | high | 7.2 | 3% |
| CVE-2021-24820 | cost-calculator (WordPress plugin) | The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) | medium | 6.5 | 3% |
| CVE-2019-15824 | wps-hide-login (WordPress plugin) | The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass. | critical | 9.8 | 3% |
| CVE-2019-15825 | wps-hide-login (WordPress plugin) | The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass. | critical | 9.8 | 3% |
| CVE-2019-15826 | wps-hide-login (WordPress plugin) | The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field. | critical | 9.8 | 3% |
| CVE-2024-34082 | getgrav/grav | Grav Vulnerable to Arbitrary File Read to Account Takeover | high | 8.5 | 3% |
| CVE-2020-15094 | symfony/http-kernel, symfony/symfony | RCE in Symfony | high | 8.0 | 3% |
| CVE-2022-1597 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its | medium | 6.1 | 3% |
| CVE-2021-24240 | business-hours-pro (WordPress plugin) | The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionali | critical | 9.8 | 3% |
| CVE-2024-8252 | clean-login (WordPress plugin) | The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' a | high | 8.8 | 3% |
| CVE-2021-25036 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audi | high | 8.8 | 3% |
| CVE-2017-14848 | wphrm-human-resource-management-system (WordPress plugin) | WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter. | high | 8.8 | 3% |
| CVE-2012-2400 | WordPress core | Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors. | high | 10.0 | 3% |
| CVE-2015-10136 | gi-media-library (WordPress plugin) | The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allow | high | 7.5 | 3% |