Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0671 | froxlor/froxlor | froxlor is vulnerable to privilege escalation from customer to root via directory-options | high | 8.8 | 1% |
| CVE-2013-4321 | typo3/cms | TYPO3 vulnerable to remote authenticated arbitrary code execution | high | 0.0 | 1% |
| CVE-2024-25298 | redaxo/source | Code injection in REDAXO | high | 7.2 | 1% |
| CVE-2023-48217 | statamic/cms | Statamic CMS vulnerable to remote code execution via form uploads | high | 8.8 | 1% |
| CVE-2017-20064 | elefant/cms | Code injection in Elefant CMS | high | 8.8 | 1% |
| CVE-2019-16108 | phpbb/phpbb | phpBB arbitrary CSS injection | high | 7.5 | 1% |
| CVE-2023-38877 | gugoan/economizzer | Economizzer host header injection vulnerability | high | 8.8 | 1% |
| CVE-2023-6996 | shortcode-to-display-post-and-user-data (WordPress plugin) | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin | high | 8.8 | 1% |
| CVE-2025-3642 | moodle/moodle | Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository | high | 8.8 | 1% |
| CVE-2022-35944 | october/system | October CMS Safe Mode bypass leads to authenticated Remote Code Execution | high | 7.2 | 1% |
| CVE-2020-11056 | barrelstrength/sprout-base-email, barrelstrength/sprout-forms | Potential Code Injection in Sprout Forms | high | 7.4 | 1% |
| CVE-2025-3641 | moodle/moodle | Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository | high | 8.8 | 1% |
| CVE-2024-48514 | maestroerror/php-heic-to-jpg | Remote code execution in php-heic-to-jpg | critical | 9.8 | 1% |
| CVE-2026-27823 | egroupware/egroupware | EGroupware has a Remote Code Execution Vulnerability | critical | 0.0 | 1% |
| CVE-2025-64050 | redaxo/source | REDAXO CMS is vulnerable to RCE attack through its template management component | high | 7.2 | 1% |
| CVE-2024-34461 | tribalsystems/zenario | Zenario uses Twig filters insecurely in the Twig Snippet plugin | critical | 9.8 | 1% |
| CVE-2025-57811 | craftcms/cms | Craft CMS Potential Remote Code Execution via Twig SSTI | medium | 0.0 | 1% |
| CVE-2021-24721 | loco-translate (WordPress plugin) | The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension endi | medium | 6.5 | 1% |
| CVE-2024-36694 | opencart/opencart | openCart Server-Side Template Injection (SSTI) vulnerability | high | 8.0 | 1% |
| CVE-2026-25510 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor | critical | 9.9 | 1% |
| CVE-2015-10009 | nonfiction/nterchange | nterchange Code Injection vulnerability | critical | 9.8 | 1% |
| CVE-2024-2497 | billz/raspap-webgui | RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php` | medium | 4.7 | 1% |
| CVE-2026-72819 | getgrav/grav | Grav CMS vulnerable to remote code execution via .zip file upload | high | 8.8 | 1% |
| CVE-2023-4994 | allow-php-in-posts-and-pages (WordPress plugin) | The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the | critical | 9.9 | 1% |
| CVE-2023-0788 | thorsten/phpmyfaq | Code Injection in thorsten/phpmyfaq | critical | 9.8 | 1% |
| CVE-2023-44382 | october/system | October CMS safe mode bypass using Twig sandbox escape | critical | 9.1 | 1% |
| CVE-2022-3721 | froxlor/froxlor | Froxlor vulnerable to Code Injection | medium | 4.6 | 1% |
| CVE-2024-42355 | shopware/core, shopware/platform | Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag | high | 8.3 | 1% |
| CVE-2026-31857 | craftcms/cms | CraftCMS has an RCE vulnerability via relational conditionals in the control panel | high | 0.0 | 1% |
| CVE-2026-75827 | getgrav/grav | Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write | high | 8.8 | 1% |
| CVE-2024-7559 | file-manager-pro (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks | high | 8.8 | 1% |
| CVE-2022-23503 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework | high | 7.5 | 1% |
| CVE-2023-40606 | kanban-boards-for-wordpress (WordPress plugin) | Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affec | critical | 9.1 | 1% |
| CVE-2024-29477 | dolibarr/dolibarr | Dolibarr ERP CRM Code Injection vulnerability during installation | medium | 6.8 | 1% |
| CVE-2017-14077 | dapphp/securimage | Securimage HTML Injection | medium | 6.1 | 1% |
| CVE-2024-13808 | xpro-addons-for-elementor (WordPress plugin) | The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via | high | 8.8 | 1% |
| CVE-2026-52778 | yeswiki/yeswiki | YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service | critical | 9.8 | 1% |
| CVE-2024-37821 | dolibarr/dolibarr | Dolibarr arbitrary file upload vulnerability | high | 8.8 | 1% |
| CVE-2022-3245 | microweber/microweber | Microweber vulnerable to HTML Injection in create tag functionality | medium | 6.1 | 1% |
| CVE-2024-8271 | woocommerce-currency-switcher (WordPress plugin) | The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all vers | high | 7.3 | 1% |
| CVE-2026-54721 | silverstripe/userforms | silverstripe/userforms vulnerable to remote code execution via userforms email subject | high | 8.8 | 1% |
| CVE-2024-11036 | gamipress (WordPress plugin) | The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerabl | high | 7.3 | 1% |
| CVE-2024-8268 | frontend-dashboard (WordPress plugin) | The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/f | high | 8.8 | 1% |
| CVE-2026-46633 | twig/twig | Twig: PHP code injection via `{% use %}` template name | critical | 0.0 | 1% |
| CVE-2026-56382 | craftcms/cms | Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview | high | 0.0 | 1% |
| CVE-2023-43792 | baserproject/basercms | baserCMS Code Injection Vulnerability in Mail Form Feature | medium | 5.3 | 1% |
| CVE-2022-0323 | mustache/mustache | Mustache remote code injection vulnerability | high | 8.8 | 1% |
| CVE-2022-2099 | woocommerce (WordPress plugin), woocommerce/woocommerce | The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment g | medium | 4.8 | 1% |
| CVE-2026-55634 | pimcore/pimcore | Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name | critical | 9.9 | 1% |
| CVE-2024-8481 | special-text-boxes (WordPress plugin) | The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.4. | high | 7.3 | 1% |