Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0159 | extensive-vc-addons-for-wpbakery-page-builder (WordPress plugin) | The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract func | high | 7.5 | 55% |
| CVE-2010-4335 | cakephp/cakephp | CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code | high | 0.0 | 55% |
| CVE-2015-9406 | mtheme-unus (WordPress theme) | Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot | high | 7.5 | 55% |
| CVE-2025-49132 | pterodactyl/panel | Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution | critical | 10.0 | 54% |
| CVE-2021-24347 | sp-project-\&-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and | high | 8.8 | 54% |
| CVE-2019-12799 | shopware/shopware | Shopware Insecure Deserialization Vulnerability | high | 8.8 | 54% |
| CVE-2022-35650 | moodle/moodle | Moodle Arbitrary file read when importing lesson questions | high | 7.5 | 54% |
| CVE-2023-29689 | pyrocms/pyrocms | PyroCMS remote code execution vulnerability | critical | 9.8 | 53% |
| CVE-2022-0513 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason | critical | 9.8 | 53% |
| CVE-2024-23116 | centreon/centreon | Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability | high | 7.2 | 53% |
| CVE-2024-23117 | centreon/centreon | Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability | high | 7.2 | 53% |
| CVE-2024-23118 | centreon/centreon | Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability | high | 7.2 | 53% |
| CVE-2021-24307 | all-in-one-seo (WordPress plugin) | The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_to | high | 8.8 | 53% |
| CVE-2024-37843 | craftcms/cms | Craft CMS SQL injection vulnerability via the GraphQL API endpoint | critical | 9.8 | 53% |
| CVE-2024-3922 | dokan (WordPress plugin) | The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due | critical | 10.0 | 53% |
| CVE-2020-27615 | loginizer (WordPress plugin) | The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip | critical | 9.8 | 53% |
| CVE-2021-36393 | moodle/moodle | Moodle SQL Injection vulnerability | critical | 9.8 | 52% |
| CVE-2024-9061 | wp-popup-builder (WordPress plugin) | The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via | high | 7.3 | 52% |
| CVE-2021-28114 | froala/wysiwyg-editor | Cross-site Scripting in Froala WYSIWYG Editor | medium | 5.4 | 52% |
| CVE-2023-43661 | cachethq/cachet | Cachet vulnerable to Authenticated Remote Code Execution | critical | 9.1 | 52% |
| CVE-2023-6567 | learnpress (WordPress plugin) | The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and includ | critical | 9.8 | 51% |
| CVE-2023-6187 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro | high | 7.5 | 51% |
| CVE-2022-0557 | microweber/microweber | OS Command Injection in Microweber | high | 7.8 | 51% |
| CVE-2022-26960 | studio-42/elfinder | Path Traversal in Studio-42 elFinder through 2.1.60 | critical | 9.1 | 51% |
| CVE-2024-5084 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in | critical | 9.8 | 51% |
| CVE-2021-34646 | woocommerce-jetpack (WordPress plugin) | Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the proces | critical | 9.8 | 51% |
| CVE-2023-6623 | essential-blocks (WordPress plugin) | The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when renderin | critical | 9.8 | 51% |
| CVE-2021-44427 | francoisjacquet/rosariosis | SQL Injection in rosariosis | critical | 9.8 | 51% |
| CVE-2014-9308 | wp-easycart (WordPress plugin) | Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart | medium | 6.5 | 51% |
| CVE-2016-5385 | amphp/artax, bugsnag/bugsnag-laravel, drupal/core +4 more | HTTP Proxy header vulnerability | high | 8.1 | 50% |
| CVE-2024-1380 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the | medium | 5.3 | 50% |
| CVE-2018-16159 | gift-vouchers (WordPress plugin) | The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_do | critical | 9.8 | 50% |
| CVE-2024-8275 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function | critical | 9.8 | 50% |
| CVE-2020-13756 | sabberworm/php-css-parser | Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors() | critical | 9.8 | 50% |
| CVE-2012-3363 | zendframework/zendframework1 | Zend Framework XXE Vulnerability | high | 7.3 | 49% |
| CVE-2020-6010 | learnpress (WordPress plugin) | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection | high | 8.8 | 49% |
| CVE-2025-2563 | user-registration-\&-membership (WordPress plugin) | The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon | high | 8.1 | 49% |
| CVE-2022-0679 | narnoo-distributor (WordPress plugin) | The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call | critical | 9.8 | 48% |
| CVE-2020-28948 | pear/archive_tar, drupal/core | Multiple vulnerabilities through filename manipulation in Archive_Tar | high | 7.8 | 47% |
| CVE-2021-24370 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote cod | critical | 9.8 | 47% |
| CVE-2020-15299 | kingcomposer (WordPress plugin) | A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick | medium | 6.1 | 47% |
| CVE-2020-8771 | wp-time-capsule (WordPress plugin) | The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client | critical | 9.8 | 46% |
| CVE-2024-53457 | librenms/librenms | LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section | medium | 5.4 | 46% |
| CVE-2018-9118 | wp-background-takeover-advertisements (WordPress plugin) | exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a | high | 7.5 | 46% |
| CVE-2022-1476 | all-in-one-wp-migration (WordPress plugin) | The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file v | medium | 6.6 | 46% |
| CVE-2023-2982 | miniorange-login-openid (WordPress plugin) | The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in | critical | 9.8 | 46% |
| CVE-2014-6446 | infusionsoft (WordPress plugin) | The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to | high | 7.5 | 46% |
| CVE-2015-9323 | 404-to-301 (WordPress plugin) | The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection. | critical | 9.8 | 46% |
| CVE-2021-24442 | poll\,-survey\,-questionnaire-and-voting-system (WordPress plugin) | The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST | critical | 9.8 | 46% |
| CVE-2014-9013 | wpmarketplace (WordPress plugin) | The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to c | high | 8.8 | 46% |