Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-1002003 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2018-1002004 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2021-24406 | wpforo-forum (WordPress plugin) | The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open | medium | 6.1 | 3% |
| CVE-2021-25120 | easy-social-feed (WordPress plugin) | The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outpu | medium | 6.1 | 3% |
| CVE-2017-1002013 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slidesh | critical | 9.8 | 3% |
| CVE-2017-1002014 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php | critical | 9.8 | 3% |
| CVE-2017-1002015 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php | critical | 9.8 | 3% |
| CVE-2024-8911 | latepoint (WordPress plugin) | The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.1 | critical | 9.8 | 3% |
| CVE-2013-2204 | WordPress core | moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider | medium | 4.3 | 3% |
| CVE-2021-3311 | october/rain | October CMS Session ID not invalidated after logout | critical | 9.8 | 3% |
| CVE-2003-1598 | WordPress core | SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the | high | 7.5 | 3% |
| CVE-2022-1595 | hc-custom-wp-admin-url (WordPress plugin) | The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request | medium | 5.3 | 3% |
| CVE-2020-29555 | getgrav/grav | Grav CMS Arbitrary File Deletion | high | 8.1 | 3% |
| CVE-2016-1000130 | e-search (WordPress plugin) | Reflected XSS in wordpress plugin e-search v1.0 | medium | 6.1 | 3% |
| CVE-2017-11675 | zencart/zencart | Authenticated RCE in Zen Cart 1.5.5e | high | 8.8 | 3% |
| CVE-2019-13578 | givewp (WordPress plugin) | A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerab | critical | 9.8 | 3% |
| CVE-2016-0769 | eshop-plugin (WordPress plugin) | Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execu | high | 8.8 | 3% |
| CVE-2021-36024 | magento/community-edition, magento/project-community-edition | Magento is affected by an os command injection via the Data collection endpoint | high | 7.2 | 3% |
| CVE-2021-36028 | magento/community-edition, magento/project-community-edition | Magento has an XML Injection vulnerability | critical | 0.0 | 3% |
| CVE-2018-20149 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended | medium | 5.4 | 3% |
| CVE-2017-14622 | 2kb-amazon-affiliates-store (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attack | medium | 6.1 | 3% |
| CVE-2015-7695 | zendframework/zendframework1 | Zend Framework SQL injection vector using null byte for PDO | critical | 9.8 | 3% |
| CVE-2023-3277 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, | critical | 9.8 | 3% |
| CVE-2018-19968 | phpmyadmin/phpmyadmin | phpMyAdmin Local file inclusion through transformation feature | medium | 6.5 | 3% |
| CVE-2017-5493 | WordPress core | wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, whic | high | 7.5 | 3% |
| CVE-2013-6797 | blue-wrench-videos-widget (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordP | medium | 6.8 | 3% |
| CVE-2018-6010 | yiisoft/yii2, yiisoft/yii2-dev | Yii Framework reflected Cross-site Scripting | high | 7.5 | 3% |
| CVE-2018-9110 | studio-42/elfinder | Directory Traversal in Studio 42 elFinder | critical | 9.1 | 3% |
| CVE-2005-2110 | WordPress core | WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via (1) a direct request to menu-header.php or a "1" v | medium | 5.0 | 3% |
| CVE-2024-0399 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL st | high | 8.1 | 3% |
| CVE-2018-0504 | mediawiki/core | Mediawiki information disclosure vulnerability | medium | 6.5 | 3% |
| CVE-2014-9098 | contus-video-gallery (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before | low | 3.5 | 3% |
| CVE-2017-5612 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7. | medium | 6.1 | 3% |
| CVE-2020-17362 | nova-lite (WordPress theme) | search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. | medium | 6.1 | 3% |
| CVE-2022-0142 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inje | critical | 9.8 | 3% |
| CVE-2024-6624 | json-api-user (WordPress plugin) | The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to imp | critical | 9.8 | 3% |
| CVE-2009-2431 | WordPress core | WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by | medium | 5.0 | 3% |
| CVE-2017-6814 | WordPress core | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) misha | medium | 5.4 | 3% |
| CVE-2021-36040 | magento/community-edition, magento/project-community-edition | Magento has a file extension restrictions bypass | critical | 9.1 | 3% |
| CVE-2015-5227 | landing-pages (WordPress plugin) | The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter. | high | 8.8 | 3% |
| CVE-2021-24773 | download-manager (WordPress plugin) | The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing h | medium | 4.8 | 3% |
| CVE-2005-1102 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to ex | medium | 6.8 | 3% |
| CVE-2012-2403 | WordPress core | wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote | medium | 4.3 | 3% |
| CVE-2006-3390 | WordPress core | WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-a | medium | 5.0 | 3% |
| CVE-2012-4919 | gallery (WordPress plugin) | Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability | critical | 9.8 | 3% |
| CVE-2016-4825 | welcart-e-commerce (WordPress plugin) | The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute | medium | 5.6 | 3% |
| CVE-2014-4030 | jw-player-plugin-for-wordpress (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the aut | medium | 6.8 | 3% |
| CVE-2016-5838 | WordPress core | WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie. | high | 7.5 | 3% |
| CVE-2015-4703 | rename (WordPress plugin) | Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to | medium | 5.3 | 3% |
| CVE-2014-8585 | download-manager (WordPress plugin) | Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via | medium | 5.0 | 3% |