Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-14990 | WordPress core | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), | medium | 6.5 | 2% |
| CVE-2009-2854 | WordPress core | Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or addition | medium | 6.4 | 2% |
| CVE-2021-24358 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted UR | medium | 6.1 | 2% |
| CVE-2021-36030 | magento/community-edition, magento/project-community-edition | Magento allows attackers to alter the price of items | high | 0.0 | 2% |
| CVE-2022-34255 | magento/community-edition | Magento Improper Access Control vulnerability | high | 8.8 | 2% |
| CVE-2014-4939 | enl-newsletter (WordPress plugin) | SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to | medium | 6.5 | 2% |
| CVE-2014-7153 | image-gallery (WordPress plugin) | SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress al | medium | 6.5 | 2% |
| CVE-2021-25078 | affiliates-manager (WordPress plugin) | The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click t | medium | 6.1 | 2% |
| CVE-2012-6112 | moodle/moodle | PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests | medium | 0.0 | 2% |
| CVE-2023-41330 | knplabs/knp-snappy | Snappy PHAR deserialization vulnerability | critical | 9.8 | 2% |
| CVE-2019-11886 | yellow-pencil-visual-theme-customizer (WordPress plugin) | The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update | high | 8.8 | 2% |
| CVE-2015-1000009 | google-adsense-and-hotel-booking (WordPress plugin) | Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05 | critical | 9.1 | 2% |
| CVE-2017-1002009 | membership-simplified (WordPress plugin) | Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulner | critical | 9.8 | 2% |
| CVE-2017-1002010 | membership-simplified (WordPress plugin) | Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulner | critical | 9.8 | 2% |
| CVE-2022-0678 | microweber/microweber | Cross-site Scripting in microweber | medium | 6.5 | 2% |
| CVE-2024-9186 | funnelkit-automations (WordPress plugin) | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does | high | 8.6 | 2% |
| CVE-2022-39365 | pimcore/pimcore | RCE vulnerability in Pimcore/Mail & Dynamic Text Layout | critical | 9.8 | 2% |
| CVE-2023-5540 | moodle/moodle | Moodle Code Injection vulnerability | high | 8.8 | 2% |
| CVE-2020-36730 | cmp (WordPress plugin) | The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv | high | 8.3 | 2% |
| CVE-2014-5182 | yawpp (WordPress plugin) | Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to | medium | 6.0 | 2% |
| CVE-2019-19617 | phpmyadmin/phpmyadmin | phpMyAdmin unsanitized Git information | critical | 9.8 | 2% |
| CVE-2022-2444 | visualizer (WordPress plugin) | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 're | high | 8.8 | 2% |
| CVE-2011-4941 | matomo/matomo, piwik/piwik | Piwik (now Matomo) Vulnerable to Arbitrary Code Execution | medium | 0.0 | 2% |
| CVE-2024-13869 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file | high | 7.2 | 2% |
| CVE-2019-15646 | rsvpmaker (WordPress plugin) | The rsvpmaker plugin before 6.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2022-34254 | magento/community-edition | Magento Path Traversal vulnerability | high | 8.5 | 2% |
| CVE-2011-3841 | wp-symposium (WordPress plugin) | Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows | medium | 4.3 | 2% |
| CVE-2018-16809 | dolibarr/dolibarr | Dolibarr SQL injection via the integer parameters qty and value_unit | critical | 9.8 | 2% |
| CVE-2021-38360 | wp-publications (WordPress plugin) | The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser | high | 8.3 | 2% |
| CVE-2021-3603 | phpmailer/phpmailer | PHPMailer untrusted code may be run from an overridden address validator | high | 8.1 | 2% |
| CVE-2019-10912 | symfony/cache, symfony/phpunit-bridge, symfony/symfony +2 more | Deserialization of untrusted data in Symfony | high | 7.1 | 2% |
| CVE-2014-4664 | wordfence (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbit | medium | 4.3 | 2% |
| CVE-2021-25008 | code-snippets (WordPress plugin) | The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, l | medium | 6.1 | 2% |
| CVE-2014-8754 | ad-manager (WordPress plugin) | Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arb | medium | 5.8 | 2% |
| CVE-2014-0173 | jetpack (WordPress plugin) | The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4 | medium | 5.8 | 2% |
| CVE-2018-13258 | mediawiki/core | Mediawiki tarball is missing .htaccess files | medium | 5.3 | 2% |
| CVE-2013-2202 | WordPress core | WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity dec | medium | 4.3 | 2% |
| CVE-2021-24959 | wp-email-users (WordPress plugin) | The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available | high | 8.8 | 2% |
| CVE-2019-18888 | symfony/http-foundation, symfony/mime, symfony/symfony | Argument injection in a MimeTypeGuesser in Symfony | high | 7.5 | 2% |
| CVE-2021-39350 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/v | medium | 6.1 | 2% |
| CVE-2017-16759 | librenms/librenms | LibreNMS Arbitrary File Read | medium | 5.9 | 2% |
| CVE-2014-0808 | ec-cube/ec-cube | EC-CUBE vulnerable to authorization bypass | medium | 5.3 | 2% |
| CVE-2018-21004 | rsvpmaker (WordPress plugin) | The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2021-24746 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes | medium | 6.1 | 2% |
| CVE-2020-18326 | intelliants/subrion | Cross Site Request Forgery in intelliants/subrion | high | 8.8 | 2% |
| CVE-2021-36032 | magento/community-edition, magento/project-community-edition | Magento is affected by an improper input validation vulnerability | high | 8.8 | 2% |
| CVE-2012-5853 | cardoza-ajax-search (WordPress plugin) | SQL injection vulnerability in the "the_search_function" function in cardoza_ajax_search.php in the AJAX Post Search (cardoza-ajax-search) p | high | 7.5 | 2% |
| CVE-2023-7164 | backwpup (WordPress plugin) | The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attac | high | 7.5 | 2% |
| CVE-2019-18622 | phpmyadmin/phpmyadmin | SQL injection in phpMyAdmin | critical | 9.8 | 2% |
| CVE-2018-19970 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 2% |