Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-6230 | wp-ban (WordPress plugin) | WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a c | medium | 4.3 | 2% |
| CVE-2023-6421 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one. | high | 7.5 | 2% |
| CVE-2017-5490 | WordPress core | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7. | medium | 6.1 | 2% |
| CVE-2021-34643 | skaut-bazar (WordPress plugin) | The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar | medium | 6.1 | 2% |
| CVE-2014-0165 | WordPress core | WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related | medium | 4.0 | 2% |
| CVE-2016-10955 | cysteme-finder (WordPress plugin) | The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking. | critical | 9.8 | 2% |
| CVE-2022-39369 | apereo/phpcas | phpCAS vulnerable to Service Hostname Discovery Exploitation | high | 8.0 | 2% |
| CVE-2015-7319 | appointment-booking-calendar (WordPress plugin) | SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 fo | high | 7.5 | 2% |
| CVE-2020-7241 | wp-database-backup (WordPress plugin) | The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. | high | 7.5 | 2% |
| CVE-2019-16699 | sjbr/sr-freecap | sr_freecap for Typo3 RCE Vulnerability | critical | 9.8 | 2% |
| CVE-2018-10366 | rainlab/user-plugin | User Plugin for October CSS Allows XSS | medium | 6.1 | 2% |
| CVE-2014-7847 | moodle/moodle | Moodle allows attackers to cause a denial of service | medium | 0.0 | 2% |
| CVE-2021-24222 | wp-curriculo-vitae-free (WordPress plugin) | The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is emb | critical | 9.8 | 2% |
| CVE-2015-9446 | unite-gallery-lite (WordPress plugin) | The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php. | high | 8.8 | 2% |
| CVE-2020-35124 | mautic/core | XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic | critical | 0.0 | 2% |
| CVE-2015-10133 | subscribe-to-comments (WordPress plugin) | The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header | high | 7.2 | 2% |
| CVE-2017-16807 | getkirby/cms | Kirby XSS Vulnerability | medium | 5.4 | 2% |
| CVE-2019-7930 | magento/community-edition, magento/product-community-edition | Magento 2 Community Unrestricted File Upload | high | 7.2 | 2% |
| CVE-2014-9035 | WordPress core | Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0 | medium | 4.3 | 2% |
| CVE-2014-9036 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remo | medium | 4.3 | 2% |
| CVE-2013-1843 | typo3/cms-core | TYPO3 Open redirect vulnerability in the Access tracking mechanism | medium | 5.3 | 2% |
| CVE-2016-11018 | gallery-images (WordPress plugin) | An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone | critical | 9.8 | 2% |
| CVE-2019-12240 | virim (WordPress plugin) | The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php. | critical | 9.8 | 2% |
| CVE-2006-0931 | pear/archive_tar | PEAR::Archive_Tar Directory Traversal vulnerability | critical | 9.1 | 2% |
| CVE-2022-0710 | header-footer-code-manager (WordPress plugin) | The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page' | medium | 6.1 | 2% |
| CVE-2016-9814 | simplesamlphp/saml2 | SimpleSAMLphp SAML2 spoof SAML responses | critical | 9.1 | 2% |
| CVE-2019-7932 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2024-0324 | profile-builder (WordPress plugin) | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | high | 8.2 | 2% |
| CVE-2021-21020 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control | medium | 5.3 | 2% |
| CVE-2025-2558 | the-wound (WordPress plugin) | The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, | high | 8.6 | 2% |
| CVE-2011-4293 | moodle/moodle | Moodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory | medium | 0.0 | 2% |
| CVE-2014-7845 | moodle/moodle | Moodle Temporary Passwords are Brute Force-able | high | 0.0 | 2% |
| CVE-2019-9574 | hrm (WordPress plugin) | The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Ad | high | 7.5 | 2% |
| CVE-2021-36034 | magento/community-edition, magento/project-community-edition | Magento affected by remote code execution via a file upload | high | 7.2 | 2% |
| CVE-2021-36041 | magento/community-edition, magento/project-community-edition | Magento vulnerable to file upload attack | high | 7.2 | 2% |
| CVE-2011-4595 | prettylinks (WordPress plugin) | Pretty-Link WordPress plugin 1.5.2 has XSS | medium | 6.1 | 2% |
| CVE-2015-3647 | wp-photo-album-plus (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for Wor | medium | 4.3 | 2% |
| CVE-2007-3215 | phpmailer/phpmailer | PHPMailer Shell command injection | high | 0.0 | 2% |
| CVE-2012-1834 | cms-tree-page-view (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 f | medium | 4.3 | 2% |
| CVE-2013-7341 | moodle/moodle, typo3/cms | Moodle cross-site scripting (XSS) vulnerabilities | medium | 0.0 | 2% |
| CVE-2018-18942 | baserproject/basercms | RCE in baserCMS before 4.1.4 | high | 7.2 | 2% |
| CVE-2023-24249 | encore/laravel-admin | laravel-admin has Arbitrary File Upload vulnerability | high | 7.2 | 2% |
| CVE-2017-11503 | phpmailer/phpmailer | Cross-site scripting in PHPMailer | medium | 6.1 | 2% |
| CVE-2024-1209 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via dire | medium | 5.3 | 2% |
| CVE-2022-28221 | antispam (WordPress plugin) | The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] paramet | medium | 6.1 | 2% |
| CVE-2021-3943 | moodle/moodle | Moodle vulnerable to RCE via unsafe deserialization | critical | 9.8 | 2% |
| CVE-2010-3663 | typo3/cms-backend | TYPO3 Arbitrary Code Execution vulnerability on the backend | high | 8.8 | 2% |
| CVE-2015-6805 | mdc-private-message (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject a | low | 3.5 | 2% |
| CVE-2018-1999009 | october/october | October CMS Local File Inclusion | high | 8.1 | 2% |
| CVE-2007-3639 | WordPress core | WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via (1) t | medium | 4.0 | 2% |