Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-9185 | bolt/bolt | Bolt Unrestricted Upload of File with Dangerous Type | high | 8.8 | 3% |
| CVE-2025-10353 | melisplatform/melis-cms-slider | Melis Platform CMS Unauthenticated File Upload Leading to RCE | critical | 0.0 | 3% |
| CVE-2014-5346 | disqus-comment-system (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to | medium | 6.8 | 3% |
| CVE-2018-25080 | mobiledetect/mobiledetectlib | Cross-site Scripting in MobileDetect | medium | 6.1 | 3% |
| CVE-2015-4336 | xcloner (WordPress plugin) | cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file co | medium | 6.5 | 3% |
| CVE-2015-1000003 | filedownload (WordPress plugin) | Blind SQL Injection in filedownload v1.4 wordpress plugin | critical | 9.8 | 3% |
| CVE-2015-1000011 | dukapress (WordPress plugin) | Blind SQL Injection in wordpress plugin dukapress v2.5.9 | critical | 9.8 | 3% |
| CVE-2015-8350 | cta (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to injec | medium | 6.1 | 3% |
| CVE-2024-5522 | html5-video-player (WordPress plugin) | The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL s | medium | 6.5 | 3% |
| CVE-2018-10101 | WordPress core | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. | medium | 6.1 | 3% |
| CVE-2022-2174 | microweber/microweber | Cross-site Scripting in Microweber | medium | 6.1 | 3% |
| CVE-2024-0705 | payment-gateway-stripe-and-woocommerce-integration (WordPress plugin) | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, | critical | 9.8 | 3% |
| CVE-2021-24375 | motor (WordPress plugin) | Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handler | critical | 9.8 | 3% |
| CVE-2022-3360 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which coul | high | 8.1 | 3% |
| CVE-2016-10966 | real3d-flipbook-lite (WordPress plugin) | The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload. | high | 7.5 | 3% |
| CVE-2023-2744 | wp-erp (WordPress plugin) | The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST | high | 7.2 | 3% |
| CVE-2018-19041 | media-file-manager (WordPress plugin) | The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax | medium | 6.1 | 3% |
| CVE-2018-10100 | WordPress core | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. | medium | 6.1 | 3% |
| CVE-2018-1000527 | froxlor/froxlor | Froxlor PHP Object Injection vulnerability | high | 7.2 | 3% |
| CVE-2017-8382 | admidio/admidio | admidio CSRF Vulnerability | medium | 4.5 | 3% |
| CVE-2026-46725 | mmc/ceselector | TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector) | critical | 0.0 | 3% |
| CVE-2015-7873 | phpmyadmin/phpmyadmin | phpMyAdmin allows remote attackers to spoof content via the url parameter | high | 0.0 | 3% |
| CVE-2022-24665 | php-everywhere (WordPress plugin) | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able | critical | 9.9 | 3% |
| CVE-2015-2084 | easy-social-icons (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack | medium | 6.8 | 3% |
| CVE-2015-1493 | moodle/moodle | Moodle directory traversal vulnerability | medium | 0.0 | 3% |
| CVE-2016-5730 | phpmyadmin/phpmyadmin | phpMyAdmin full path disclosure vulnerability | medium | 5.3 | 3% |
| CVE-2020-28038 | WordPress core | WordPress before 5.5.2 allows stored XSS via post slugs. | medium | 6.1 | 3% |
| CVE-2014-9037 | WordPress core | WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an acc | medium | 6.8 | 3% |
| CVE-2017-6818 | WordPress core | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. | medium | 6.1 | 3% |
| CVE-2019-13275 | wp-statistics (WordPress plugin) | An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-def | critical | 9.8 | 3% |
| CVE-2019-18854 | safe-svg (WordPress plugin) | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion f | high | 7.5 | 3% |
| CVE-2019-18855 | safe-svg (WordPress plugin) | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted | high | 7.5 | 3% |
| CVE-2022-0597 | microweber/microweber | Open redirect in microweber | medium | 6.1 | 3% |
| CVE-2021-24356 | simple-301-redirects (WordPress plugin) | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJ | high | 8.8 | 3% |
| CVE-2018-1002009 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2011-4956 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspec | medium | 4.3 | 3% |
| CVE-2010-1593 | silverstripe/cms, silverstripe/framework | SilverStripe vulnerable to Cross-site Scripting | low | 0.0 | 3% |
| CVE-2015-1436 | easing-slider (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrar | medium | 4.3 | 3% |
| CVE-2020-4043 | maikuolan/phpmussel, phpmussel/phpmussel | Phar unserialization vulnerability in phpMussel | high | 7.7 | 3% |
| CVE-2014-8336 | wp-dbmanager (WordPress plugin) | The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary | medium | 6.5 | 3% |
| CVE-2021-24407 | jannah (WordPress plugin) | The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to | medium | 6.1 | 3% |
| CVE-2020-36510 | 15zine (WordPress plugin) | The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s | medium | 6.1 | 3% |
| CVE-2014-2681 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 3% |
| CVE-2025-4334 | wp-registration (WordPress plugin) | The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is d | critical | 9.8 | 3% |
| CVE-2021-24132 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plug | high | 8.8 | 3% |
| CVE-2020-28033 | WordPress core | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. | high | 7.5 | 3% |
| CVE-2019-20211 | citybook (WordPress plugin), easybook (WordPress plugin), townhub (WordPress plugin) | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing A | medium | 6.1 | 3% |
| CVE-2019-20212 | citybook (WordPress plugin), easybook (WordPress plugin), townhub (WordPress plugin) | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat | medium | 6.1 | 3% |
| CVE-2018-1002007 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2018-1002008 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |