Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-13575 | everest-forms (WordPress plugin) | A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerab | critical | 9.8 | 3% |
| CVE-2007-0262 | WordPress core | WordPress 2.0.6, and 2.1Alpha 3 (SVN:4662), does not properly verify that the m parameter value has the string data type, which allows remot | high | 7.8 | 3% |
| CVE-2017-1002027 | rk-responsive-contact-form (WordPress plugin) | Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query | critical | 9.8 | 3% |
| CVE-2022-2180 | greyd.suite (WordPress plugin) | The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf che | critical | 9.8 | 3% |
| CVE-2005-2109 | WordPress core | wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the | medium | 5.0 | 3% |
| CVE-2016-2041 | phpmyadmin/phpmyadmin | phpMyAdmin Unsafe comparison of XSRF/CSRF token | high | 7.5 | 3% |
| CVE-2008-0191 | WordPress core | WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the defaul | medium | 5.0 | 3% |
| CVE-2020-12479 | nilsteampassnet/teampass | TeamPass PHP arbitrary file include vulnerability | high | 8.8 | 3% |
| CVE-2016-5839 | WordPress core | WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors. | high | 7.5 | 3% |
| CVE-2011-3122 | WordPress core | Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media securi | high | 10.0 | 3% |
| CVE-2009-3696 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting In MySQL Table Name | medium | 0.0 | 3% |
| CVE-2019-7725 | nukeviet/nukeviet | Deserialization of Untrusted Data in NukeViet | critical | 9.8 | 3% |
| CVE-2025-3616 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val | high | 8.8 | 3% |
| CVE-2014-9177 | html5-mp3-player-with-playlist (WordPress plugin) | The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a reques | medium | 5.0 | 3% |
| CVE-2017-14724 | WordPress core | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. | medium | 6.1 | 3% |
| CVE-2014-4163 | featured-comments (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hij | medium | 6.8 | 3% |
| CVE-2005-2107 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary | medium | 4.3 | 3% |
| CVE-2017-1002016 | flickr-picture-backup (WordPress plugin) | Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is au | critical | 9.8 | 3% |
| CVE-2023-5241 | chatbot (WordPress plugin) | The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_open | critical | 9.6 | 3% |
| CVE-2015-3904 | roomcloud (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress allow remote attackers | medium | 4.3 | 3% |
| CVE-2014-8089 | zendframework/zend-db, zendframework/zendframework, zendframework/zendframework1 | Zend Framework SQL injection vulnerability | critical | 9.8 | 3% |
| CVE-2023-38208 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Neutralization of Special Elements Used | critical | 9.1 | 3% |
| CVE-2008-3747 | WordPress core | The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force S | high | 7.5 | 3% |
| CVE-2019-16220 | WordPress core | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open r | medium | 6.1 | 3% |
| CVE-2015-8125 | symfony/form, symfony/security, symfony/security-http +1 more | Symfony Vulnerable to Timing Attack | high | 0.0 | 3% |
| CVE-2016-9853 | phpmyadmin/phpmyadmin | phpMyAdmin path disclosure | medium | 5.3 | 3% |
| CVE-2011-3818 | WordPress core | WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the ins | medium | 5.0 | 3% |
| CVE-2023-2359 | slider-revolution (WordPress plugin) | The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload | high | 8.8 | 3% |
| CVE-2012-10001 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote | critical | 9.8 | 3% |
| CVE-2020-9457 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vuln | high | 8.8 | 3% |
| CVE-2010-5293 | WordPress core | wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote | medium | 5.8 | 3% |
| CVE-2020-4049 | WordPress core | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript | low | 2.4 | 3% |
| CVE-2017-18515 | wp-statistics (WordPress plugin) | The wp-statistics plugin before 12.0.8 for WordPress has SQL injection. | critical | 9.8 | 3% |
| CVE-2019-16700 | slub/slub-events | slub_events for Typo3 Arbitrary File Upload | critical | 9.8 | 3% |
| CVE-2026-56700 | getgrav/grav | Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass | critical | 0.0 | 3% |
| CVE-2023-0586 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and inc | medium | 6.4 | 3% |
| CVE-2019-7412 | ps-phpcaptcha (WordPress plugin) | The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values. | critical | 9.8 | 3% |
| CVE-2021-42171 | tribalsystems/zenario | Unrestricted Upload of File with Dangerous Type in Zenario CMS | critical | 9.8 | 3% |
| CVE-2006-4743 | WordPress core | WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, | medium | 5.0 | 3% |
| CVE-2020-19316 | laravel/framework | OS Command Injection in Laravel Framework | high | 8.8 | 3% |
| CVE-2012-6531 | zendframework/zendframework1 | Zend Framework XEE Vulnerability | medium | 0.0 | 3% |
| CVE-2016-6634 | WordPress core | Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary we | medium | 6.1 | 3% |
| CVE-2020-9456 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privilege | high | 8.8 | 3% |
| CVE-2020-9458 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privilege | high | 8.8 | 3% |
| CVE-2017-15079 | wp-smushit (WordPress plugin) | The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. | high | 7.5 | 3% |
| CVE-2018-0588 | ultimate-member (WordPress plugin) | Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attacker | high | 7.5 | 3% |
| CVE-2014-7958 | bulletproof-security (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allow | medium | 4.3 | 3% |
| CVE-2006-0868 | pear/auth | PEAR::Auth potential authentication bypass vulnerability | high | 0.0 | 3% |
| CVE-2016-6565 | nextgen-gallery (WordPress plugin) | The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a | high | 7.5 | 3% |
| CVE-2014-10390 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal. | critical | 9.1 | 3% |