Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-18586 | insert-pages (WordPress plugin) | The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths. | critical | 9.1 | 3% |
| CVE-2015-2199 | audio-player (WordPress plugin) | Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users | medium | 6.5 | 3% |
| CVE-2012-6511 | organizer (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote att | medium | 4.3 | 3% |
| CVE-2020-11515 | seo-by-rank-math (WordPress plugin) | The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external | medium | 6.1 | 3% |
| CVE-2007-4165 | blue-memories-theme (WordPress theme) | Cross-site scripting (XSS) vulnerability in index.php in the Blue Memories theme 1.5 for WordPress allows remote attackers to inject arbitra | medium | 4.3 | 3% |
| CVE-2015-2171 | slim/slim | Slim vulnerable to PHP object injection | high | 0.0 | 2% |
| CVE-2014-8088 | zendframework/zend-ldap, zendframework/zendframework, zendframework/zendframework1 | Anonymous authentication in ldap_bind() function of PHP, using null byte | medium | 0.0 | 2% |
| CVE-2023-24813 | dompdf/dompdf | URI validation failure on SVG parsing. Bypass of CVE-2023-23924 | critical | 10.0 | 2% |
| CVE-2022-3357 | smart-slider-3 (WordPress plugin) | The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection i | high | 8.8 | 2% |
| CVE-2021-36567 | topthink/framework | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | 2% |
| CVE-2013-6243 | landing-pages (WordPress plugin) | SQL injection vulnerability in the Landing Pages plugin 1.2.3, before 20131009, and earlier for WordPress allows remote attackers to execute | high | 7.5 | 2% |
| CVE-2023-30260 | billz/raspap-webgui | RaspAP raspap-webgui Command Injection vulnerability | high | 8.8 | 2% |
| CVE-2021-24351 | the-plus-addons-for-elementor (WordPress plugin) | The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise som | medium | 6.1 | 2% |
| CVE-2019-15521 | spoon/library | Spoon Library as used in Fork CMS allows PHP object injection | critical | 9.8 | 2% |
| CVE-2012-0287 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows rem | low | 2.6 | 2% |
| CVE-2022-24775 | guzzlehttp/psr7, drupal/core | Improper Input Validation in guzzlehttp/psr7 | medium | 5.3 | 2% |
| CVE-2013-0236 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML | medium | 4.3 | 2% |
| CVE-2021-36029 | magento/community-edition, magento/project-community-edition | Magento improper authorization vulnerability | high | 7.2 | 2% |
| CVE-2023-4451 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | medium | 6.1 | 2% |
| CVE-2017-1002018 | eventr (WordPress plugin) | Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL | critical | 9.8 | 2% |
| CVE-2017-1002019 | eventr (WordPress plugin) | Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL | critical | 9.8 | 2% |
| CVE-2021-20682 | baserproject/basercms | OS Command Injection in baserCMS | high | 7.2 | 2% |
| CVE-2019-20043 | WordPress core | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the r | medium | 4.3 | 2% |
| CVE-2020-17952 | topthink/think | Code injection in topthink/think | critical | 9.8 | 2% |
| CVE-2021-36042 | magento/community-edition, magento/project-community-edition | Magento executes code via the API File Option Upload Extension | critical | 9.1 | 2% |
| CVE-2023-5089 | defender-security (WordPress plugin) | The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, a | medium | 5.3 | 2% |
| CVE-2016-3168 | drupal/core, drupal/drupal | Drupal Reflected file download vulnerability | medium | 6.4 | 2% |
| CVE-2021-24383 | wp-go-maps (WordPress plugin) | The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin | medium | 5.4 | 2% |
| CVE-2008-3218 | drupal/drupal | Drupal vulnerable to Cross-site Scripting | medium | 0.0 | 2% |
| CVE-2020-7047 | wordpress-database-reset (WordPress plugin) | The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability | high | 8.8 | 2% |
| CVE-2023-6444 | seriously-simple-podcasting (WordPress plugin) | The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin ema | medium | 5.3 | 2% |
| CVE-2019-20173 | login-by-auth0 (WordPress plugin) | The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. | medium | 6.1 | 2% |
| CVE-2014-9039 | WordPress core | wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset p | medium | 4.3 | 2% |
| CVE-2012-4437 | smarty/smarty | Cross-site Scripting in SmartyException | medium | 0.0 | 2% |
| CVE-2014-7182 | wp-google-maps (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to injec | medium | 4.3 | 2% |
| CVE-2019-17230 | onetone (WordPress theme) | includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes. | medium | 5.3 | 2% |
| CVE-2023-49052 | microweber/microweber | Microweber file upload vulnerability | high | 8.8 | 2% |
| CVE-2019-20360 | givewp (WordPress plugin) | A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally id | high | 7.5 | 2% |
| CVE-2019-8135 | magento/community-edition, magento/product-community-edition | Remote code execution via vulnerable Symphony dependecy injection | critical | 9.8 | 2% |
| CVE-2021-3818 | getgrav/grav | Reliance on Cookies without Validation and Integrity Checking in getgrav/grav | medium | 6.3 | 2% |
| CVE-2020-35945 | divi (WordPress plugin), divi-builder (WordPress plugin), extra (WordPress plugin) | An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, wi | critical | 9.9 | 2% |
| CVE-2022-44588 | cryptocurrency-widgets-pack (WordPress plugin) | Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress. | critical | 9.9 | 2% |
| CVE-2011-3128 | WordPress core | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain se | medium | 5.0 | 2% |
| CVE-2021-43608 | doctrine/dbal | DBAL 3 SQL Injection Security Vulnerability | critical | 9.8 | 2% |
| CVE-2015-2062 | huge-it-slider (WordPress plugin) | Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to | high | 7.2 | 2% |
| CVE-2025-0520 | showdoc/showdoc | ShowDoc unrestricted file upload vulnerability | critical | 0.0 | 2% |
| CVE-2014-10076 | wp-db-backup (WordPress plugin) | The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers | high | 7.5 | 2% |
| CVE-2025-14675 | wpmetabox/meta-box | Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file | high | 7.2 | 2% |
| CVE-2011-3125 | WordPress core | Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various secu | high | 10.0 | 2% |
| CVE-2020-5244 | buddypress/buddypress | Private data exposure via REST API in BuddyPress | high | 8.0 | 2% |