Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2732 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insuffici | critical | 9.8 | 67% |
| CVE-2024-3552 | web-directory-free (WordPress plugin) | The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX | critical | 9.8 | 67% |
| CVE-2022-0832 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 67% |
| CVE-2021-24321 | bello (WordPress plugin) | The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_no | critical | 9.8 | 67% |
| CVE-2022-0218 | wp-html-mail (WordPress plugin) | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme s | high | 8.3 | 66% |
| CVE-2021-39316 | zoomsounds (WordPress plugin) | The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be dow | high | 7.5 | 66% |
| CVE-2020-36708 | activello (WordPress plugin), affluent (WordPress plugin), allegiant (WordPress plugin) +13 more | The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, | critical | 9.8 | 65% |
| CVE-2022-4830 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 65% |
| CVE-2022-21662 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticate | high | 8.0 | 65% |
| CVE-2018-19422 | intelliants/subrion | Subrion CMS RCE Vulnerability | high | 7.2 | 65% |
| CVE-2018-1000207 | modx/revolution | MODX Revolution Incorrect Access Control vulnerability | high | 7.2 | 64% |
| CVE-2022-1609 | school-management (WordPress plugin) | The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a | critical | 9.8 | 64% |
| CVE-2022-1429 | pimcore/pimcore | SQL Injection found in Pimcore | high | 7.5 | 64% |
| CVE-2023-5652 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before | critical | 9.8 | 64% |
| CVE-2020-26935 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection vulnerability | critical | 9.8 | 64% |
| CVE-2024-50340 | symfony/runtime, symfony/symfony | Symfony allows changing the environment through a query | high | 7.3 | 64% |
| CVE-2019-14205 | adaptive-images (WordPress plugin) | A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arb | high | 7.5 | 63% |
| CVE-2023-6360 | my-calendar (WordPress plugin) | The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' pa | high | 8.6 | 63% |
| CVE-2018-16283 | wechat-brodcast (WordPress plugin) | The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter. | critical | 9.8 | 63% |
| CVE-2022-25772 | mautic/core | Cross-site Scripting vulnerability in Mautic's tracking pixel functionality | critical | 9.6 | 63% |
| CVE-2024-8522 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/ | critical | 10.0 | 63% |
| CVE-2023-1578 | pimcore/pimcore | Pimcore Remote Code Execution vulnerability in Search function | medium | 6.5 | 63% |
| CVE-2018-7422 | site-editor (WordPress plugin) | A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary fil | high | 7.5 | 62% |
| CVE-2018-12895 | WordPress core | WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb param | high | 8.8 | 62% |
| CVE-2015-4133 | reflex-gallery (WordPress plugin) | Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows | high | 7.5 | 62% |
| CVE-2016-1209 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized | critical | 9.8 | 62% |
| CVE-2017-1000119 | october/cms | October CMS PHP Code Execution | high | 7.2 | 61% |
| CVE-2023-2249 | wpforo (WordPress plugin) | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions | high | 8.8 | 61% |
| CVE-2014-4725 | wysija-newsletters (WordPress plugin) | The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute | high | 7.5 | 61% |
| CVE-2024-27921 | getgrav/grav | Grav File Upload Path Traversal | high | 8.8 | 61% |
| CVE-2023-0631 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes d | high | 8.8 | 60% |
| CVE-2020-35234 | easy-wp-smtp (WordPress plugin) | The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an a | high | 7.5 | 60% |
| CVE-2021-24499 | workreap (WordPress plugin) | The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform non | critical | 9.8 | 60% |
| CVE-2024-11972 | hunk-companion (WordPress plugin) | The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to | critical | 9.8 | 59% |
| CVE-2014-10021 | wp-symposium (WordPress plugin) | Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execut | high | 7.5 | 59% |
| CVE-2008-5619 | phpmailer/phpmailer | PHPMailer susceptible to arbitrary code execution | high | 0.0 | 59% |
| CVE-2023-22249 | magento/community-edition | Magento Open Source allows Cross-Site Scripting (XSS) | medium | 4.8 | 58% |
| CVE-2015-1172 | holding-pattern (WordPress theme) | Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordP | high | 7.5 | 58% |
| CVE-2018-14773 | symfony/http-foundation, symfony/symfony | Symfony HTTP Foundation web cache poisoning | medium | 6.5 | 58% |
| CVE-2017-7309 | mantisbt/mantisbt | MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php | medium | 4.8 | 57% |
| CVE-2023-23492 | login-with-phone-number (WordPress plugin) | The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' param | high | 8.8 | 57% |
| CVE-2021-24472 | kentharadio (WordPress plugin), onair2 (WordPress plugin) | The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticat | critical | 9.8 | 57% |
| CVE-2023-6989 | wp-simple-firewall (WordPress plugin) | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all v | critical | 9.8 | 57% |
| CVE-2024-34716 | prestashop/prestashop | PrestaShop cross-site scripting via customer contact form in FO, through file upload | critical | 9.6 | 56% |
| CVE-2022-1104 | popup-maker (WordPress plugin) | The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege use | medium | 4.8 | 56% |
| CVE-2025-1661 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, a | critical | 9.8 | 56% |
| CVE-2021-39352 | catch-themes-demo-import (WordPress plugin) | The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchT | high | 7.2 | 56% |
| CVE-2021-25003 | wpcargo-track-\&-trace (WordPress plugin) | The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anyw | critical | 9.8 | 56% |
| CVE-2025-6970 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ | high | 7.5 | 56% |
| CVE-2025-5961 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file | high | 7.2 | 55% |