Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-6965 | contact-form-generator (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote | medium | 6.8 | 3% |
| CVE-2020-22276 | weforms (WordPress plugin) | WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry. | critical | 9.8 | 3% |
| CVE-2008-2717 | typo3/cms-core | TYPO3 Unrestricted File Upload vulnerability | medium | 0.0 | 3% |
| CVE-2007-1894 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject | medium | 4.3 | 3% |
| CVE-2017-6925 | drupal/core, drupal/drupal | Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions | critical | 9.8 | 3% |
| CVE-2023-0827 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.3 | 3% |
| CVE-2007-0106 | WordPress core | Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary | medium | 6.8 | 3% |
| CVE-2017-6514 | WordPress core | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a / | medium | 5.3 | 3% |
| CVE-2015-0902 | all-in-one-seo-pack (WordPress plugin) | The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation | medium | 5.0 | 3% |
| CVE-2013-2205 | WordPress core | The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote atta | medium | 4.3 | 3% |
| CVE-2023-1112 | drag-and-drop-multiple-file-upload---contact-form-7 (WordPress plugin) | A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Aff | medium | 4.7 | 3% |
| CVE-2020-10738 | moodle/moodle | Moodle vulnerable to RCE | high | 8.8 | 3% |
| CVE-2022-3384 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dro | high | 7.2 | 3% |
| CVE-2020-36157 | ultimate-member (WordPress plugin) | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. | critical | 10.0 | 3% |
| CVE-2013-4701 | openid/php-openid, typo3/cms | PHP OpenID Library Denial of Service vulnerability | high | 0.0 | 3% |
| CVE-2015-1000001 | fast-image-adder (WordPress plugin) | Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin | critical | 9.8 | 3% |
| CVE-2024-9796 | wp-advanced-search (WordPress plugin) | The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allo | critical | 9.8 | 3% |
| CVE-2014-8621 | store-locator (WordPress plugin) | SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL comm | critical | 9.8 | 3% |
| CVE-2014-0214 | moodle/moodle | Moodle creates a MoodleMobile web-service token with an infinite lifetime | medium | 0.0 | 3% |
| CVE-2019-16197 | dolibarr/dolibarr | Cross-site scripting in Dolibarr | medium | 6.1 | 3% |
| CVE-2019-3465 | robrichards/xmlseclibs | Signature validation bypass in XmlSecLibs | high | 8.8 | 3% |
| CVE-2015-9316 | wp-fastest-cache (WordPress plugin) | The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via t | critical | 9.8 | 3% |
| CVE-2021-25052 | button-generation (WordPress plugin) | The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extens | high | 8.8 | 3% |
| CVE-2016-7405 | adodb/adodb-php | ADOdb Library SQL Injection | critical | 9.8 | 3% |
| CVE-2020-13664 | drupal/core, drupal/drupal | Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances. An attacker could trick an admin | high | 8.8 | 3% |
| CVE-2006-1012 | WordPress core | SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL com | high | 7.5 | 3% |
| CVE-2022-1398 | external-media-without-import (WordPress plugin) | The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via UR | medium | 6.5 | 3% |
| CVE-2022-4140 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which cou | high | 7.5 | 3% |
| CVE-2015-1000000 | mailcwp (WordPress plugin) | Remote file upload vulnerability in mailcwp v1.99 wordpress plugin | critical | 9.8 | 3% |
| CVE-2021-24719 | enfold (WordPress plugin) | The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfol | medium | 6.1 | 3% |
| CVE-2017-1002023 | easy-team-manager (WordPress plugin) | Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file | critical | 9.8 | 3% |
| CVE-2016-5739 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-Site Request Forgery | high | 7.5 | 3% |
| CVE-2018-1002001 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2006-3389 | WordPress core | index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged param | medium | 5.0 | 3% |
| CVE-2018-9109 | studio-42/elfinder | elFinder Path Traversal vulnerability | critical | 9.1 | 3% |
| CVE-2022-0992 | security-optimizer (WordPress plugin) | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administr | critical | 9.8 | 3% |
| CVE-2009-3631 | typo3/cms-backend | TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name | high | 0.0 | 3% |
| CVE-2011-5286 | social-slider (WordPress plugin) | SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider plugin before 7.4.2 for WordPress allows remote attackers to ex | high | 7.5 | 3% |
| CVE-2014-4938 | wp-rss-poster (WordPress plugin) | SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL | high | 7.5 | 3% |
| CVE-2025-1323 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in a | high | 7.5 | 3% |
| CVE-2017-12061 | mantisbt/mantisbt | MantisBT XSS allows unsanitized input via admin/install.php | medium | 6.1 | 3% |
| CVE-2020-11476 | concrete5/concrete5 | Unrestricted Uploads in Concrete5 | high | 7.2 | 3% |
| CVE-2022-28222 | antispam (WordPress plugin) | The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] paramet | medium | 6.1 | 3% |
| CVE-2021-21015 | magento/community-edition | Magento OS command injection via the customer attribute save controller | high | 8.0 | 3% |
| CVE-2016-1564 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to in | medium | 6.1 | 3% |
| CVE-2021-24235 | goto (WordPress plugin) | The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthe | medium | 6.1 | 3% |
| CVE-2020-13666 | drupal/core, drupal/drupal | The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting. | medium | 6.1 | 3% |
| CVE-2020-9588 | magento/community-edition, magento/core, magento/project-community-edition | Magento Signature verification bypass | high | 7.2 | 3% |
| CVE-2006-2702 | WordPress core | vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP | medium | 5.0 | 3% |
| CVE-2018-1002002 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |