Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-2315 | thank-you-counter-button (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inj | medium | 4.3 | 2% |
| CVE-2015-3880 | phpbb/phpbb | phpBB Open Redirect | medium | 6.1 | 2% |
| CVE-2016-6233 | zendframework/zendframework, zendframework/zendframework1 | Zend Framework Allows SQL Injection | critical | 9.8 | 2% |
| CVE-2019-15322 | shortcode-factory (WordPress plugin) | The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion. | critical | 9.8 | 2% |
| CVE-2021-43836 | sulu/sulu | PHP file inclusion in the Sulu admin panel | high | 8.5 | 2% |
| CVE-2018-20153 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causi | medium | 5.4 | 2% |
| CVE-2014-100023 | mtouch-quiz (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to | medium | 4.3 | 2% |
| CVE-2014-4520 | dmca-watermarker (WordPress plugin) | Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker plugin before 1.1 for WordPress allows remote attackers to i | medium | 4.3 | 2% |
| CVE-2014-4524 | easy-post-types (WordPress plugin) | Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allow | medium | 4.3 | 2% |
| CVE-2014-4554 | ss-downloads (WordPress plugin) | Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads plugin before 1.5 for WordPress allows remote attacke | medium | 4.3 | 2% |
| CVE-2014-4569 | videowhisper-live-streaming-integration (WordPress plugin) | Cross-site scripting (XSS) vulnerability in ls/vv_login.php in the VideoWhisper Live Streaming Integration plugin 4.27.2 and earlier for Wor | medium | 4.3 | 2% |
| CVE-2014-4574 | webengage (WordPress plugin) | Cross-site scripting (XSS) vulnerability in resize.php in the WebEngage plugin before 2.0.1 for WordPress allows remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4594 | wp-responsive-preview (WordPress plugin) | Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote atta | medium | 4.3 | 2% |
| CVE-2015-1384 | banner-effect-header (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arb | medium | 4.3 | 2% |
| CVE-2018-20984 | patreon-connect (WordPress plugin) | The patreon-connect plugin before 1.2.2 for WordPress has Object Injection. | critical | 9.8 | 2% |
| CVE-2019-7861 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Unsafe File Upload | high | 7.5 | 2% |
| CVE-2021-24176 | jh-404-logger (WordPress plugin) | The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, wh | medium | 5.4 | 2% |
| CVE-2011-5304 | sodahead-polls (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Sodahead Polls plugin before 2.0.4 for WordPress allow remote attackers to inject | medium | 4.3 | 2% |
| CVE-2019-12474 | mediawiki/core | Wikimedia information leak vulnerability | high | 7.5 | 2% |
| CVE-2023-4300 | import-xml-and-rss-feeds (WordPress plugin) | The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to uploa | high | 7.2 | 2% |
| CVE-2021-39321 | sassy-social-share (WordPress plugin) | Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJ | high | 8.8 | 2% |
| CVE-2005-1688 | WordPress core | Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, ( | medium | 5.3 | 2% |
| CVE-2024-10708 | system-dashboard (WordPress plugin) | The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such | medium | 4.9 | 2% |
| CVE-2012-4226 | quick-post-widget (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitra | medium | 4.3 | 2% |
| CVE-2013-7129 | blooog-theme (WordPress theme) | Cross-site scripting (XSS) vulnerability in ThemeBeans Blooog theme 1.1 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2014-100008 | js-multi-hotel (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) | medium | 4.3 | 2% |
| CVE-2014-100016 | photocrati (WordPress theme) | Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress allows remote attackers | medium | 4.3 | 2% |
| CVE-2014-10016 | e-commerce (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject a | medium | 4.3 | 2% |
| CVE-2014-7139 | contact-form-7-to-database-extension (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before | medium | 4.3 | 2% |
| CVE-2014-7956 | pods (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2014-9176 | sexy-squeeze-pages (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject arbit | medium | 4.3 | 2% |
| CVE-2015-2069 | woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary w | medium | 4.3 | 2% |
| CVE-2015-2220 | ninja-forms (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to injec | medium | 4.3 | 2% |
| CVE-2021-36012 | magento/community-edition, magento/project-community-edition | Magento affected by a business logic error in the placeOrder graphql mutation | medium | 6.5 | 2% |
| CVE-2022-2535 | searchwp-live-ajax-search (WordPress plugin) | The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts o | medium | 5.3 | 2% |
| CVE-2024-43965 | sendgrid (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress all | high | 8.2 | 2% |
| CVE-2020-24315 | cardoza-wordpress-poll (WordPress plugin) | Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input | high | 7.5 | 2% |
| CVE-2023-0291 | quiz-master-next (WordPress plugin) | The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated | high | 7.2 | 2% |
| CVE-2015-2973 | welcart-e-commerce (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbit | medium | 4.3 | 2% |
| CVE-2018-19994 | dolibarr/dolibarr | Dolibarr error-based SQL injection vulnerability in product/card.php | high | 8.8 | 2% |
| CVE-2017-5543 | intelliants/subrion | Subrion CMS PHP Object Injection | critical | 9.8 | 2% |
| CVE-2014-3937 | contextual-related-posts (WordPress plugin) | SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrar | high | 7.5 | 2% |
| CVE-2018-7586 | nextgen-gallery (WordPress plugin) | In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured. | high | 7.5 | 2% |
| CVE-2022-0208 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad | medium | 6.1 | 2% |
| CVE-2007-1409 | WordPress core | WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the p | medium | 5.0 | 2% |
| CVE-2017-18536 | stop-user-enumeration (WordPress plugin) | The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS. | medium | 6.1 | 2% |
| CVE-2022-0254 | bmarshall511/wordpress_zero_spam, zero-spam (WordPress plugin) | SQL Injection in WordPress Zero Spam WordPress plugin | critical | 9.8 | 2% |
| CVE-2019-15866 | crelly-slider (WordPress plugin) | The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_im | high | 8.8 | 2% |
| CVE-2024-1210 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. | medium | 5.3 | 2% |
| CVE-2019-15323 | ad-inserter (WordPress plugin) | The ad-inserter plugin before 2.4.20 for WordPress has path traversal. | high | 7.5 | 2% |