Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-11872 | wordpress-popup (WordPress plugin) | The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a | high | 8.8 | 2% |
| CVE-2020-15873 | librenms/librenms | LibreNMS SQL Injection vulnerability | medium | 6.5 | 2% |
| CVE-2015-1385 | powerpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to i | medium | 4.3 | 2% |
| CVE-2019-11201 | dolibarr/dolibarr | Dolibarr ERP and CRM Code Injection | high | 8.0 | 2% |
| CVE-2025-34076 | microweber/microweber | Microweber CMS API has authenticated local file inclusion vulnerability | medium | 0.0 | 2% |
| CVE-2013-6288 | apache-solr-for-typo3/solr | Apache Solr for TYPO3 (solr) extension is vulnerable to Insecure Unserialize | critical | 9.8 | 2% |
| CVE-2023-3105 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is d | high | 8.8 | 2% |
| CVE-2022-23988 | ws-form (WordPress plugin) | The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker | medium | 6.1 | 2% |
| CVE-2018-19296 | phpmailer/phpmailer | Phar object injection in PHPMailer | high | 8.8 | 2% |
| CVE-2020-15098 | typo3/cms, typo3/cms-core | Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS | high | 8.8 | 2% |
| CVE-2020-35296 | zoujingli/thinkadmin | ThinkAdmin Admin Panel Access using Default Credentials | high | 7.5 | 2% |
| CVE-2022-0189 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX ac | medium | 6.1 | 2% |
| CVE-2014-2055 | sabre/dav | XXE in SabreDAV | high | 0.0 | 2% |
| CVE-2016-10954 | neosense (WordPress theme) | The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload. | critical | 9.8 | 2% |
| CVE-2010-2230 | moodle/moodle | Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter | medium | 0.0 | 2% |
| CVE-2019-17233 | ultimate-faqs (WordPress plugin) | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. | medium | 6.1 | 2% |
| CVE-2021-38557 | billz/raspap-webgui | raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. | high | 8.8 | 2% |
| CVE-2019-3847 | moodle/moodle | Moodle XSS Vulnerability | medium | 4.8 | 2% |
| CVE-2015-0217 | moodle/moodle | Moodle allows attackers to cause a denial of service | medium | 0.0 | 2% |
| CVE-2015-2268 | moodle/moodle | Moodle allows attackers to cause a denial of service | medium | 0.0 | 2% |
| CVE-2026-41304 | wwbn/avideo | WWBN AVideo: RCE cause by clonesite plugin | critical | 9.8 | 2% |
| CVE-2016-3169 | drupal/core, drupal/drupal | Drupal saving user accounts can sometimes grant the user all roles | high | 8.1 | 2% |
| CVE-2007-5106 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML | medium | 4.3 | 2% |
| CVE-2022-3861 | betheme (WordPress theme) | The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untr | high | 8.8 | 2% |
| CVE-2014-10389 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication. | critical | 9.8 | 2% |
| CVE-2016-10965 | real3d-flipbook-lite (WordPress plugin) | The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion. | high | 7.5 | 2% |
| CVE-2022-42096 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 2% |
| CVE-2015-4615 | easy2map-photos (WordPress plugin) | Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, paren | critical | 9.8 | 2% |
| CVE-2019-15872 | loginpress (WordPress plugin) | The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings. | critical | 9.8 | 2% |
| CVE-2018-19998 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in user/card.php | high | 8.8 | 2% |
| CVE-2016-6212 | drupal/core, drupal/drupal | Drupal Views can allow unauthorized users to see Statistics information | medium | 5.3 | 2% |
| CVE-2022-0921 | microweber/microweber | Unrestricted Upload of File with Dangerous Type in Microweber | medium | 6.7 | 2% |
| CVE-2011-3126 | WordPress core | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects. | medium | 5.0 | 2% |
| CVE-2021-24838 | anycomment (WordPress plugin) | The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() fun | medium | 6.1 | 2% |
| CVE-2021-24223 | n5-upload-form (WordPress plugin) | The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, a | critical | 9.8 | 2% |
| CVE-2008-4793 | drupal/drupal | Drupal Node Validation Bypass in the node module API | high | 0.0 | 2% |
| CVE-2015-5308 | wp-championship (WordPress plugin) | Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execu | high | 7.5 | 2% |
| CVE-2010-5297 | WordPress core | WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once chang | low | 2.1 | 2% |
| CVE-2023-49282 | microsoft/microsoft-graph | Test code in published microsoft-graph package exposes phpinfo() | medium | 5.4 | 2% |
| CVE-2023-49283 | microsoft/microsoft-graph-core | Test code in published microsoft-graph-core package exposes phpinfo() | medium | 5.4 | 2% |
| CVE-2019-6342 | drupal/core, drupal/drupal | In Drupal 8.7.4, when the [experimental](https://www.drupal.org/core/experimental#beta) Workspaces module is enabled, an | critical | 9.8 | 2% |
| CVE-2023-5203 | wp-sessions-time-monitoring-full-automatic (WordPress plugin) | The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before us | high | 7.5 | 2% |
| CVE-2019-13413 | rencontre (WordPress plugin) | The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php. | critical | 9.8 | 2% |
| CVE-2023-2606 | wp-brutal-ai (WordPress plugin) | The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 2% |
| CVE-2022-42095 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 2% |
| CVE-2019-16222 | WordPress core | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site s | medium | 6.1 | 2% |
| CVE-2017-6819 | WordPress core | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to | medium | 6.5 | 2% |
| CVE-2014-5240 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote au | low | 2.1 | 2% |
| CVE-2016-10977 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal. | medium | 6.5 | 2% |
| CVE-2020-7107 | ultimate-faqs (WordPress plugin) | The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php. | medium | 6.1 | 2% |