Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0424 | popup (WordPress plugin) | The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthe | medium | 5.3 | 3% |
| CVE-2020-7947 | auth0 (WordPress plugin) | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled | critical | 9.8 | 3% |
| CVE-2020-12675 | mappress-google-maps-for-wordpress (WordPress plugin) | The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions | high | 8.8 | 3% |
| CVE-2016-7168 | WordPress core | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might | medium | 4.8 | 3% |
| CVE-2014-2340 | xcloner-backup-and-restore (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authe | medium | 6.8 | 3% |
| CVE-2014-9032 | WordPress core | Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows r | medium | 4.3 | 3% |
| CVE-2018-21025 | centreon/centreon | Centreon Privilege Escalation | critical | 9.8 | 3% |
| CVE-2016-6211 | drupal/core, drupal/drupal | Drupal Saving user accounts can sometimes grant the user all roles | high | 8.8 | 3% |
| CVE-2016-5832 | WordPress core | The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors. | high | 7.5 | 3% |
| CVE-2013-2199 | WordPress core | The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to | medium | 4.3 | 3% |
| CVE-2022-42094 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 3% |
| CVE-2013-4240 | hms-testimonials (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers | medium | 6.8 | 3% |
| CVE-2021-41116 | composer/composer | Improper escaping of command arguments on Windows leading to command injection | high | 8.2 | 3% |
| CVE-2019-11565 | print-my-blog (WordPress plugin) | Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter. | critical | 9.8 | 3% |
| CVE-2021-27903 | craftcms/cms | Craft CMS Remote Code Injection | critical | 9.8 | 3% |
| CVE-2017-18264 | phpmyadmin/phpmyadmin | phpMyAdmin Improper Privilege Management | critical | 9.8 | 3% |
| CVE-2025-66294 | getgrav/grav | Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass | high | 0.0 | 3% |
| CVE-2016-5706 | phpmyadmin/phpmyadmin | phpMyAdmin Denial Of Service (DOS) attack | high | 7.5 | 3% |
| CVE-2013-4462 | portable-phpmyadmin (WordPress plugin) | WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability | critical | 9.1 | 3% |
| CVE-2023-37897 | getgrav/grav | grav Server-side Template Injection (SSTI) mitigation bypass | high | 7.2 | 3% |
| CVE-2017-6815 | WordPress core | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. | medium | 6.1 | 3% |
| CVE-2021-36025 | magento/community-edition, magento/project-community-edition | Magento is affected by an improper input validation vulnerability while saving a customer's details | critical | 9.1 | 3% |
| CVE-2021-24962 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path travers | high | 8.8 | 3% |
| CVE-2014-4717 | simple-share-buttons-adder (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote at | medium | 6.8 | 3% |
| CVE-2021-34551 | phpmailer/phpmailer | Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows | high | 8.1 | 3% |
| CVE-2019-17675 | WordPress core | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CS | high | 8.8 | 3% |
| CVE-2024-7627 | file-manager (WordPress plugin) | The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. Th | high | 8.1 | 3% |
| CVE-2017-9516 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 5.4 | 3% |
| CVE-2017-15919 | ultimate-form-builder-lite (WordPress plugin) | The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin- | critical | 9.8 | 3% |
| CVE-2021-24997 | wp-guppy (WordPress plugin) | The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them a | medium | 6.5 | 3% |
| CVE-2016-10993 | scoreme (WordPress theme) | The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter. | medium | 5.4 | 3% |
| CVE-2015-4039 | wp-membership (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inje | medium | 5.4 | 3% |
| CVE-2022-0994 | hummingbird (WordPress plugin) | The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as | medium | 4.8 | 3% |
| CVE-2024-6159 | push-notification-for-post-and-buddypress (WordPress plugin) | The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using i | critical | 9.8 | 3% |
| CVE-2023-5559 | 10web-booster (WordPress plugin) | The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated use | critical | 9.1 | 3% |
| CVE-2012-2404 | WordPress core | wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site | medium | 4.3 | 3% |
| CVE-2022-33901 | multisafepay (WordPress plugin) | Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress. | medium | 5.3 | 3% |
| CVE-2024-45293 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | 3% |
| CVE-2007-3240 | WordPress core | Cross-site scripting (XSS) vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary w | medium | 4.3 | 3% |
| CVE-2015-9479 | acf-fronted-display (WordPress plugin) | The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery | critical | 9.8 | 3% |
| CVE-2018-7204 | file-manager (WordPress plugin) | inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/fi | high | 7.5 | 3% |
| CVE-2019-25213 | advanced-access-manager (WordPress plugin) | The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9. | critical | 9.8 | 3% |
| CVE-2021-21024 | magento/community-edition | Magento Blind SQL Injection in the Search module | critical | 9.1 | 3% |
| CVE-2015-9351 | feed-them-social (WordPress plugin) | The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button. | critical | 9.8 | 3% |
| CVE-2019-20042 | WordPress core | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a | medium | 6.1 | 3% |
| CVE-2023-28115 | knplabs/knp-snappy | PHAR deserialization allowing remote code execution | critical | 9.8 | 3% |
| CVE-2019-8144 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | critical | 9.8 | 3% |
| CVE-2025-2075 | uncanny-automator (WordPress plugin) | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation | high | 8.8 | 3% |
| CVE-2021-24596 | youforms-free-for-copecart (WordPress plugin) | The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege use | medium | 4.8 | 3% |
| CVE-2016-5837 | WordPress core | WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspec | high | 7.5 | 3% |