Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9466 | wti-like-post (WordPress plugin) | The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, H | critical | 9.8 | 2% |
| CVE-2015-9467 | broken-link-manager (WordPress plugin) | The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter. | critical | 9.8 | 2% |
| CVE-2017-9418 | testimonials-plugin-easy-testimonials (WordPress plugin) | SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands | high | 8.8 | 2% |
| CVE-2019-17661 | admin-columns (WordPress plugin) | A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control | high | 8.8 | 2% |
| CVE-2019-15780 | formidable (WordPress plugin) | The formidable plugin before 4.02.01 for WordPress has unsafe deserialization. | critical | 9.8 | 2% |
| CVE-2022-0928 | microweber/microweber | Cross-site Scripting in microweber | medium | 6.8 | 2% |
| CVE-2014-7138 | google-calendar-events (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject a | medium | 4.3 | 2% |
| CVE-2014-2853 | mediawiki/core | Cross-site scripting vulnerability in includes/actions/InfoAction.php | medium | 0.0 | 2% |
| CVE-2019-15839 | sina-extension-for-elementor (WordPress plugin) | The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. | high | 7.5 | 2% |
| CVE-2020-25911 | modx/revolution | XML External Entity vulnerability in MODX CMS | critical | 9.1 | 2% |
| CVE-2024-6265 | userswp (WordPress plugin) | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnera | critical | 9.8 | 2% |
| CVE-2015-3397 | yiisoft/yii2, yiisoft/yii2-bootstrap, yiisoft/yii2-dev +2 more | Yii Framework Cross-site Scripting Vulnerability | medium | 0.0 | 2% |
| CVE-2019-8141 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2022-1544 | luyadev/yii-helpers | Improper neutralization of formula elements in yii-helpers | high | 7.8 | 2% |
| CVE-2015-5267 | moodle/moodle | Moodle uses predictable password-recovery tokens | high | 7.5 | 2% |
| CVE-2014-6315 | photo-gallery-plugin (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote att | medium | 4.3 | 2% |
| CVE-2024-12008 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the public | medium | 5.3 | 2% |
| CVE-2015-9451 | plugmatter-optin-feature-box-lite (WordPress plugin) | The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailc | critical | 9.8 | 2% |
| CVE-2015-9452 | nex-forms-express-wp-form-builder (WordPress plugin) | The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex | critical | 9.8 | 2% |
| CVE-2017-12869 | simplesamlphp/simplesamlphp | SimpleSAMLphp Authentication context bypass in the multiauth module | high | 7.5 | 2% |
| CVE-2018-11407 | symfony/security, symfony/security-core, symfony/symfony | Symfony Authentication Bypass | critical | 9.8 | 2% |
| CVE-2021-36023 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the Widgets Update Layout | critical | 9.1 | 2% |
| CVE-2007-4139 | WordPress core | Cross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, a | medium | 4.3 | 2% |
| CVE-2012-1605 | typo3/cms | Typo3 Extbase Framework Unsafe Deserialization | medium | 0.0 | 2% |
| CVE-2021-39173 | cachethq/cachet | Cachet vulnerable to forced reinstall | high | 8.8 | 2% |
| CVE-2013-5738 | WordPress core | The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability f | medium | 4.3 | 2% |
| CVE-2022-0779 | user-meta-user-profile-builder-and-user-management (WordPress plugin) | The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could a | medium | 6.5 | 2% |
| CVE-2021-37708 | shopware/core, shopware/platform | Command injection in mail agent settings | high | 8.8 | 2% |
| CVE-2021-24664 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not es | medium | 4.8 | 2% |
| CVE-2020-10804 | phpmyadmin/phpmyadmin | phpMyAdmin SQL Injection | high | 8.0 | 2% |
| CVE-2024-7985 | fileorganizer (WordPress plugin) | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type | high | 7.5 | 2% |
| CVE-2014-2683 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2014-9283 | captcha (WordPress plugin) | The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain admi | medium | 5.0 | 2% |
| CVE-2015-0890 | google-captcha (WordPress plugin) | The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mec | medium | 5.0 | 2% |
| CVE-2015-6829 | wp-limit-login-attempts (WordPress plugin) | Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0 | high | 7.5 | 2% |
| CVE-2024-6486 | imagemagick-engine (WordPress plugin) | The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_pa | high | 7.2 | 2% |
| CVE-2020-23489 | wwbn/avideo | AVideo vulnerable to Improper Privilege Management | high | 8.8 | 2% |
| CVE-2018-7198 | rainlab/blog-plugin | October CMS - RainLab Blog Plugin XSS | medium | 6.1 | 2% |
| CVE-2021-39322 | easy-social-icons (WordPress plugin) | The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configur | medium | 6.1 | 2% |
| CVE-2019-12241 | carts-guru (WordPress plugin) | The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handle | critical | 9.8 | 2% |
| CVE-2019-12516 | slickquiz (WordPress plugin) | The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=s | high | 8.8 | 2% |
| CVE-2015-4109 | users-ultra (WordPress plugin) | Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to | high | 7.5 | 2% |
| CVE-2015-1204 | wp-slimstat (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remot | medium | 4.3 | 2% |
| CVE-2006-6017 | WordPress core | WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote auth | medium | 6.5 | 2% |
| CVE-2013-2083 | moodle/moodle | Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class | medium | 0.0 | 2% |
| CVE-2023-23490 | survey-maker (WordPress plugin) | The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' paramet | high | 8.8 | 2% |
| CVE-2020-35700 | librenms/librenms | SQL Injection in librenms | high | 8.8 | 2% |
| CVE-2018-11494 | opencart/opencart | OpenCart Path Traversal | high | 8.0 | 2% |
| CVE-2014-100022 | mtouch-quiz (WordPress plugin) | SQL injection vulnerability in question.php in the mTouch Quiz before 3.0.7 for WordPress allows remote attackers to execute arbitrary SQL c | high | 7.5 | 2% |
| CVE-2017-18605 | gravitate-qa-tracker (WordPress plugin) | The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection. | critical | 9.8 | 2% |