Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-21022 | magento/community-edition, magento/project-community-edition | Magento Insecure Direct Object Reference (IDOR) in the product module | medium | 5.3 | 2% |
| CVE-2018-18018 | slideshow-gallery (WordPress plugin) | SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&metho | critical | 9.8 | 2% |
| CVE-2024-55889 | thorsten/phpmyfaq | thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames | medium | 4.9 | 2% |
| CVE-2013-2108 | cleanfix (WordPress plugin) | WordPress WP Cleanfix Plugin 2.4.4 has CSRF | medium | 5.4 | 2% |
| CVE-2020-7948 | auth0 (WordPress plugin) | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference. | high | 8.8 | 2% |
| CVE-2020-12790 | nystudio107/craft-seomatic | SEOmatic for CraftCMS allows Server-Side Template Injection | high | 7.5 | 2% |
| CVE-2023-5539 | moodle/moodle | Moodle Code Injection vulnerability | medium | 4.7 | 2% |
| CVE-2022-0594 | shareaholic (WordPress plugin) | The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one | medium | 5.3 | 2% |
| CVE-2021-25112 | whmcs-bridge (WordPress plugin) | The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, | medium | 6.1 | 2% |
| CVE-2017-14725 | WordPress core | Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. | medium | 5.4 | 2% |
| CVE-2019-1010054 | dolibarr/dolibarr | Dolibarr Cross Site Request Forgery (CSRF) | high | 8.8 | 2% |
| CVE-2024-13496 | gamipress (WordPress plugin) | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-b | high | 7.5 | 2% |
| CVE-2015-9450 | plugmatter-optin-feature-box-lite (WordPress plugin) | The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pm | critical | 9.8 | 2% |
| CVE-2019-13572 | blog2social (WordPress plugin) | The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. | critical | 9.8 | 2% |
| CVE-2016-5733 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-site Scripting | medium | 6.1 | 2% |
| CVE-2019-15713 | my-calendar (WordPress plugin) | The my-calendar plugin before 3.1.10 for WordPress has XSS. | medium | 6.1 | 2% |
| CVE-2014-2682 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2021-36879 | ulisting (WordPress plugin) | Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration all | critical | 9.8 | 2% |
| CVE-2023-5843 | ads-by-datafeedrcom (WordPress plugin) | The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ | critical | 9.0 | 2% |
| CVE-2022-4949 | adsanity (WordPress plugin) | The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function | high | 8.8 | 2% |
| CVE-2018-14065 | phpoffice/common | PHPOffice Common Improper Restriction of XML External Entity Reference | critical | 9.8 | 2% |
| CVE-2019-15318 | yikes-inc-easy-mailchimp-extender (WordPress plugin) | The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field. | critical | 9.8 | 2% |
| CVE-2016-1000144 | photoxhibit (WordPress plugin) | Reflected XSS in wordpress plugin photoxhibit v2.1.8 | medium | 6.1 | 2% |
| CVE-2016-1000145 | pondol-carousel (WordPress plugin) | Reflected XSS in wordpress plugin pondol-carousel v1.0 | medium | 6.1 | 2% |
| CVE-2016-1000147 | recipes-writer (WordPress plugin) | Reflected XSS in wordpress plugin recipes-writer v1.0.4 | medium | 6.1 | 2% |
| CVE-2016-1000150 | simplified-content (WordPress plugin) | Reflected XSS in wordpress plugin simplified-content v1.0.0 | medium | 6.1 | 2% |
| CVE-2016-1000151 | tera-charts (WordPress plugin) | Reflected XSS in wordpress plugin tera-charts v1.0 | medium | 6.1 | 2% |
| CVE-2010-5106 | WordPress core | The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote au | medium | 6.5 | 2% |
| CVE-2022-1221 | gwyn\'s-imagemap-selector (WordPress plugin) | The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attr | medium | 6.1 | 2% |
| CVE-2016-9263 | WordPress core | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Fla | medium | 4.7 | 2% |
| CVE-2017-18634 | newspaper (WordPress theme) | The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php. | critical | 9.8 | 2% |
| CVE-2021-41243 | baserproject/basercms | OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS | critical | 9.1 | 2% |
| CVE-2015-9496 | freshmail-newsletter (WordPress plugin) | The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring. | high | 8.8 | 2% |
| CVE-2019-12464 | librenms/librenms | Path Traversal in LibreNMS | high | 7.5 | 2% |
| CVE-2018-6905 | typo3/cms | Typo3 XSS Vulnerability | medium | 4.8 | 2% |
| CVE-2021-3850 | adodb/adodb-php | Authentication Bypass in ADOdb/ADOdb | critical | 9.1 | 2% |
| CVE-2020-22275 | easy-registration-forms (WordPress plugin) | Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, whe | high | 8.8 | 2% |
| CVE-2014-2316 | search-everything (WordPress plugin) | SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execu | high | 7.5 | 2% |
| CVE-2012-6144 | typo3/cms | Typo3 Backend History Module Vulnerable to SQL Injection | medium | 0.0 | 2% |
| CVE-2023-3076 | mstore-api (WordPress plugin) | The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their w | critical | 9.8 | 2% |
| CVE-2020-6859 | ultimate-member (WordPress plugin) | Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for W | medium | 5.3 | 2% |
| CVE-2020-18324 | intelliants/subrion | Cross-site Scripting in Subrion CMS | medium | 6.1 | 2% |
| CVE-2023-29918 | francoisjacquet/rosariosis | RosarioSIS vulnerable to CSV Injection | medium | 5.4 | 2% |
| CVE-2017-1000014 | phpmyadmin/phpmyadmin | phpMyAdmin DoS Vulnerability | high | 7.5 | 2% |
| CVE-2015-4617 | easy2map-photos (WordPress plugin) | Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying f | high | 7.5 | 2% |
| CVE-2019-7950 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Access Control Bypass | high | 7.5 | 2% |
| CVE-2021-25074 | webp-converter-for-media (WordPress plugin) | The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before r | medium | 6.1 | 2% |
| CVE-2025-1307 | newscrunch (WordPress theme) | The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_a | critical | 9.8 | 2% |
| CVE-2018-11366 | loginizer (WordPress plugin) | init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is | medium | 6.1 | 2% |
| CVE-2022-3401 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code bloc | high | 8.8 | 2% |