Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-7725 | concrete5/concrete5 | Concrete CMS vulnerable to cross-site scripting (XSS) | medium | 6.1 | 3% |
| CVE-2013-2714 | podpress (WordPress plugin) | Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via th | medium | 6.1 | 3% |
| CVE-2024-31211 | WordPress core | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution vi | medium | 5.5 | 3% |
| CVE-2008-7252 | phpmyadmin/phpmyadmin | phpMyAdmin unsafely handles temporary files | high | 0.0 | 3% |
| CVE-2008-2146 | WordPress core | wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remot | high | 7.5 | 3% |
| CVE-2019-12935 | shopware/shopware | Shopware Cross-site Scripting Vulnerability | medium | 6.1 | 3% |
| CVE-2018-16613 | wpforo (WordPress plugin) | An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate | critical | 9.8 | 3% |
| CVE-2017-9429 | event-list (WordPress plugin) | SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via | high | 8.8 | 3% |
| CVE-2019-14695 | popup-builder (WordPress plugin) | A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerab | critical | 9.8 | 3% |
| CVE-2023-1874 | wp-data-access (WordPress plugin) | The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack | high | 7.5 | 3% |
| CVE-2013-4340 | WordPress core | wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the A | low | 3.5 | 3% |
| CVE-2012-5868 | WordPress core | WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote a | low | 2.6 | 3% |
| CVE-2017-10993 | contao/contao, contao/core, contao/core-bundle | Contao Core directory traversal vulnerability | high | 8.8 | 3% |
| CVE-2013-0724 | wp-ecommerce-shop-styling (WordPress plugin) | PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows | high | 7.5 | 3% |
| CVE-2021-36020 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the 'City' field | high | 0.0 | 3% |
| CVE-2014-10383 | memphis-documents-library (WordPress plugin) | The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion. | critical | 9.8 | 3% |
| CVE-2021-23420 | codeception/codeception | Deserialization of Untrusted Data in codeception/codeception | critical | 9.8 | 3% |
| CVE-2014-3941 | typo3/cms | Typo3 Host Header Spoofing Vulnerability | medium | 0.0 | 3% |
| CVE-2017-14726 | WordPress core | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. | medium | 6.1 | 3% |
| CVE-2015-8124 | symfony/security, symfony/security-http, symfony/symfony | Symfony Session Fixation Vulnerability | low | 3.1 | 3% |
| CVE-2018-10309 | responsive-cookie-consent (WordPress plugin) | The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS. | medium | 5.4 | 3% |
| CVE-2022-2846 | calendar-event-multi-view (WordPress plugin) | The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event | medium | 4.3 | 3% |
| CVE-2023-37269 | wintercms/winter | Winter CMS stored XSS through privileged upload of SVG file | low | 2.0 | 3% |
| CVE-2015-4413 | nextend-facebook-connect (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plug | medium | 4.3 | 3% |
| CVE-2022-2034 | sensei-lms (WordPress plugin) | The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated user | medium | 5.3 | 3% |
| CVE-2020-35125 | mautic/core | Mautic is vulnerable to XSS vulnerability | critical | 9.6 | 3% |
| CVE-2018-17856 | joomla/framework | Joomla RCE Vulnerability | high | 7.2 | 3% |
| CVE-2014-9099 | whydowork-adsense (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the auth | medium | 6.8 | 3% |
| CVE-2017-14842 | smsmaster-multipurpose-sms-gateway (WordPress plugin) | Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14843 | school-management-system (WordPress plugin) | Mojoomla School Management System for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14844 | wpgym-gym-management-system (WordPress plugin) | Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14845 | wpchurch-church-management-system (WordPress plugin) | Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14846 | hospital-management-system (WordPress plugin) | Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14847 | wpams-apartment-management-system (WordPress plugin) | Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2018-20717 | prestashop/prestashop | PrestaShop PHP Object Injection | high | 8.8 | 3% |
| CVE-2016-1927 | phpmyadmin/phpmyadmin | phpMyAdmin Cryptographic Vulnerability | high | 7.5 | 3% |
| CVE-2018-14502 | chained-quiz (WordPress plugin) | controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrar | critical | 9.8 | 3% |
| CVE-2012-2402 | WordPress core | wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and de | medium | 5.5 | 3% |
| CVE-2015-6584 | datatables/datatables | DataTable Vulnerable to Cross-Site Scripting | high | 0.0 | 3% |
| CVE-2026-55173 | wwbn/avideo | AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command exe | high | 8.1 | 3% |
| CVE-2017-16654 | symfony/intl, symfony/symfony | Symfony Directory Traversal | high | 7.5 | 3% |
| CVE-2019-11830 | typo3/phar-stream-wrapper | PharStreamWrapper for Typo3 unsafe deserialization vulnerability | critical | 9.8 | 3% |
| CVE-2007-0541 | WordPress core | WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback s | medium | 5.0 | 3% |
| CVE-2019-7743 | joomla/joomla-cms | Joomla! Object Injection Vulnerability | critical | 9.8 | 3% |
| CVE-2020-10596 | opencart/opencart | Cross-site Scripting in OpenCart | medium | 5.4 | 3% |
| CVE-2015-6238 | google-analyticator (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to | medium | 4.3 | 3% |
| CVE-2022-3361 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient inp | medium | 4.3 | 3% |
| CVE-2011-0700 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web scrip | low | 3.5 | 3% |
| CVE-2024-7135 | tainacan (WordPress plugin) | The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_file' function | medium | 6.5 | 3% |
| CVE-2018-16831 | smarty/smarty | Smarty Path Traversal Vulnerability | medium | 5.9 | 3% |