Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-100009 | js-multi-hotel (WordPress plugin) | The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtai | medium | 5.0 | 2% |
| CVE-2020-15159 | baserproject/basercms | Cross Site Scripting and RCE in baserCMS | high | 7.6 | 2% |
| CVE-2018-16385 | topthink/framework | ThinkPHP SQL Injection vulnerability | critical | 9.8 | 2% |
| CVE-2020-15146 | sylius/resource-bundle | Remote Code Execution in SyliusResourceBundle | critical | 9.6 | 2% |
| CVE-2014-8363 | wordpress-spreadsheet (WordPress plugin) | SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execu | high | 7.5 | 2% |
| CVE-2022-34256 | magento/community-edition | Magento Improper Authorization vulnerability | high | 7.5 | 2% |
| CVE-2019-15319 | option-tree (WordPress plugin) | The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. | critical | 9.8 | 2% |
| CVE-2019-15320 | option-tree (WordPress plugin) | The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. | critical | 9.8 | 2% |
| CVE-2019-15321 | option-tree (WordPress plugin) | The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. | critical | 9.8 | 2% |
| CVE-2018-11309 | membermouse (WordPress plugin) | Blind SQL injection in coupon_code in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the Wo | critical | 9.8 | 2% |
| CVE-2020-26511 | wpo365-login (WordPress plugin) | The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication | high | 7.5 | 2% |
| CVE-2016-6632 | phpmyadmin/phpmyadmin | phpMyAdmin Denial of service (DOS) attack with dbase extension | medium | 5.9 | 2% |
| CVE-2017-1000033 | vospari-forms (WordPress plugin) | Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascrip | medium | 6.1 | 2% |
| CVE-2021-25099 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an | medium | 6.1 | 2% |
| CVE-2008-2068 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vec | medium | 4.3 | 2% |
| CVE-2024-6330 | geo-my-wordpress (WordPress plugin) | The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution c | critical | 9.8 | 2% |
| CVE-2017-5223 | phpmailer/phpmailer | Local file disclosure in PHPMailer | medium | 5.5 | 2% |
| CVE-2021-29476 | rmccue/requests | Insecure Deserialization of untrusted data in rmccue/requests | critical | 9.8 | 2% |
| CVE-2012-1156 | moodle/moodle | Moodle backs up private files | high | 7.5 | 2% |
| CVE-2025-69200 | thorsten/phpmyfaq | phpMyFAQ has unauthenticated config backup download via /api/setup/backup | high | 7.5 | 2% |
| CVE-2019-8149 | magento/community-edition, magento/product-community-edition | Magento Broken authentication and session managememt | critical | 9.8 | 2% |
| CVE-2016-10935 | woocommerce-exporter (WordPress plugin) | The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation. | critical | 9.8 | 2% |
| CVE-2023-2571 | quiz-maker (WordPress plugin) | The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflect | medium | 6.1 | 2% |
| CVE-2015-1000008 | mp3-jplayer (WordPress plugin) | Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 | medium | 5.3 | 2% |
| CVE-2020-5203 | bcosca/fatfree | Fat-Free Framework arbitrary code execution | critical | 9.8 | 2% |
| CVE-2019-7903 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2015-7320 | appointment-booking-calendar (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calenda | medium | 4.3 | 2% |
| CVE-2016-11000 | wp-ultimate-exporter (WordPress plugin) | The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter. | critical | 9.8 | 2% |
| CVE-2014-1750 | nokia-mapsplaces (WordPress plugin) | Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirec | medium | 5.8 | 2% |
| CVE-2017-12868 | simplesamlphp/simplesamlphp | SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module | critical | 9.8 | 2% |
| CVE-2024-11396 | event-monster (WordPress plugin) | The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all vers | medium | 5.3 | 2% |
| CVE-2015-1055 | photo-gallery (WordPress plugin) | SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via th | high | 7.5 | 2% |
| CVE-2024-9161 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data d | medium | 6.5 | 2% |
| CVE-2018-20987 | newsletters-lite (WordPress plugin) | The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection. | critical | 9.8 | 2% |
| CVE-2019-1010209 | gourl (WordPress plugin) | GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload | high | 7.5 | 2% |
| CVE-2020-11029 | WordPress core | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site | medium | 5.8 | 2% |
| CVE-2011-4634 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2020-4046 | WordPress core | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inj | medium | 5.4 | 2% |
| CVE-2026-10768 | drupal/localgov_workflows | This module configures default editorial workflows for LocalGov Drupal content types. It provides a Drupal content moder | unknown | 0.0 | 2% |
| CVE-2022-30117 | concrete5/core | Path traversal in Concrete CMS | critical | 9.1 | 2% |
| CVE-2014-5196 | improved-user-search-in-backend (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend | medium | 4.3 | 2% |
| CVE-2016-5834 | WordPress core | Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 a | medium | 6.1 | 2% |
| CVE-2017-14718 | WordPress core | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. | medium | 6.1 | 2% |
| CVE-2017-14721 | WordPress core | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. | medium | 6.1 | 2% |
| CVE-2018-19271 | centreon/centreon | Centreon SQL Injection | high | 8.8 | 2% |
| CVE-2014-4672 | yiisoft/yii | Yii PHP Framework arbitrary PHP scripts execution | high | 0.0 | 2% |
| CVE-2019-6338 | drupal/drupal, drupal/core | Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data | high | 8.0 | 2% |
| CVE-2012-3527 | typo3/cms | TYPO3 allows remote authenticated backend users to unserialize arbitrary objects | medium | 0.0 | 2% |
| CVE-2007-1230 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to i | medium | 5.8 | 2% |
| CVE-2011-4283 | moodle/moodle | Moodle allows remote attackers to obtain sensitive information | medium | 0.0 | 2% |