Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10958 | wp-photo-album-plus (WordPress plugin) | The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX acti | high | 7.3 | 2% |
| CVE-2014-3942 | typo3/cms | TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code | high | 0.0 | 2% |
| CVE-2023-5550 | moodle/moodle | Moodle Code Injection vulnerability | medium | 6.5 | 2% |
| CVE-2013-1348 | symfony/symfony, symfony/yaml | Symphony Vulnerable to PHP Code Injection via YAML Parsing | high | 0.0 | 2% |
| CVE-2013-1397 | symfony/symfony, symfony/yaml | Symfony Arbitrary PHP code Execution | high | 0.0 | 2% |
| CVE-2021-20187 | moodle/moodle | Moodle Arbitrary PHP code execution by site admins via Shibboleth configuration | high | 7.2 | 2% |
| CVE-2024-28119 | getgrav/grav | Server Side Template Injection (SSTI) via Twig escape handler | high | 8.8 | 2% |
| CVE-2021-24537 | similar-posts (WordPress plugin) | The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie wit | high | 7.2 | 2% |
| CVE-2018-8073 | yiisoft/yii2-redis | yii2-redis Potential Remote code execution | critical | 9.8 | 2% |
| CVE-2023-4141 | wp-ultimate-csv-importer (WordPress plugin) | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '-> | high | 8.0 | 2% |
| CVE-2023-4142 | wp-ultimate-csv-importer (WordPress plugin) | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '-> | high | 8.0 | 2% |
| CVE-2017-14764 | genix/cms | GeniXCMS arbitrary PHP code execution | high | 8.8 | 2% |
| CVE-2022-46157 | akeneo/pim-community-dev | Akeneo PIM Community Edition vulnerable to remote php code execution | high | 8.8 | 2% |
| CVE-2022-36386 | wp-all-import (WordPress plugin) | Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. | critical | 9.1 | 1% |
| CVE-2018-8074 | yiisoft/yii2-dev, yiisoft/yii2-elasticsearch | Yii Framework Code Injection | high | 8.1 | 1% |
| CVE-2017-10844 | baserproject/basercms | Code Injection in baserCMS | high | 8.8 | 1% |
| CVE-2024-11635 | wordpress-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the | critical | 9.8 | 1% |
| CVE-2020-36655 | yiisoft/yii2-gii | Command injection in yiisoft/yii2-gii | high | 8.8 | 1% |
| CVE-2024-9772 | uix-shortcodes (WordPress plugin) | The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to | high | 7.3 | 1% |
| CVE-2023-30130 | craftcms/cms | CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter | high | 8.8 | 1% |
| CVE-2019-8230 | magento/core | Magento Remote code execution through support/output path modification | high | 7.2 | 1% |
| CVE-2019-8231 | magento/core | Magento Remote code execution through catalog attribute sets | high | 7.2 | 1% |
| CVE-2022-0896 | microweber/microweber | Improper Neutralization of Special Elements Used in a Template Engine in microweber | high | 8.8 | 1% |
| CVE-2023-24776 | funadmin/funadmin | Remote code execution in Funadmin | critical | 9.8 | 1% |
| CVE-2022-3869 | froxlor/froxlor | Froxlor vulnerable to code injection | medium | 6.1 | 1% |
| CVE-2021-44618 | nystudio107/craft-seomatic | Server-side Template Injection in nystudio107/craft-seomatic | critical | 9.8 | 1% |
| CVE-2024-28117 | getgrav/grav | Server Side Template Injection (SSTI) | high | 8.8 | 1% |
| CVE-2023-22731 | shopware/core, shopware/platform | Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views | critical | 9.8 | 1% |
| CVE-2018-20988 | wpgform (WordPress plugin) | The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation. | high | 7.5 | 1% |
| CVE-2022-0282 | microweber/microweber | Code Injection in microweber | high | 7.5 | 1% |
| CVE-2024-52293 | craftcms/cms | Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI | high | 7.2 | 1% |
| CVE-2015-2308 | symfony/http-kernel, symfony/symfony | Symfony Vulnerable to PHP Eval Injection | medium | 0.0 | 1% |
| CVE-2021-32649 | october/system | October/System authenticated file write leads to remote code execution | high | 8.8 | 1% |
| CVE-2026-45140 | chamilo/chamilo-lms | Chamilo LMS CStudio upload flow allows unauthenticated remote code execution | critical | 9.8 | 1% |
| CVE-2023-24676 | processwire/processwire | Arbitrary Code Execution in Processwire | high | 7.2 | 1% |
| CVE-2024-21546 | unisharp/laravel-filemanager | UniSharp Laravel Filemanager Code Injection vulnerability | critical | 9.8 | 1% |
| CVE-2024-11600 | borderless (WordPress plugin) | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execut | high | 7.2 | 1% |
| CVE-2023-46947 | intelliants/subrion | Subrion remote command execution vulnerability | high | 7.2 | 1% |
| CVE-2023-6743 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all ve | high | 8.8 | 1% |
| CVE-2021-37626 | contao/contao, contao/core-bundle | PHP file inclusion via insert tags | medium | 6.7 | 1% |
| CVE-2019-7871 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Unsafe File Upload | high | 8.8 | 1% |
| CVE-2019-16774 | phpfastcache/phpfastcache | Object injection in cookie driver in phpfastcache | medium | 4.4 | 1% |
| CVE-2024-28118 | getgrav/grav | Server Side Template Injection (SSTI) | high | 8.8 | 1% |
| CVE-2022-3418 | wp-all-import (WordPress plugin) | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported o | high | 7.2 | 1% |
| CVE-2022-44136 | tribalsystems/zenario | Zenario CMS is vulnerable to Remote Code Execution (RCE). | critical | 9.8 | 1% |
| CVE-2022-24711 | codeigniter4/framework | Remote CLI Command Execution Vulnerability in CodeIgniter4 | critical | 9.4 | 1% |
| CVE-2023-28333 | moodle/moodle | Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input | critical | 9.8 | 1% |
| CVE-2010-1153 | typo3/cms | TYPO3 PHP remote file inclusion vulnerability | high | 0.0 | 1% |
| CVE-2023-3551 | nilsteampassnet/teampass | TeamPass Code Injection vulnerability | critical | 9.1 | 1% |
| CVE-2023-32692 | codeigniter4/framework | Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4 | critical | 9.8 | 1% |