Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2013-2203 | WordPress core | WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an inva | medium | 4.3 | 2% |
| CVE-2012-3528 | typo3/cms | Typo3 Backend XSS Vulnerability | low | 0.0 | 2% |
| CVE-2016-6624 | phpmyadmin/phpmyadmin | phpMyAdmin IPv6 and proxy server IP-based authentication rule circumvention | medium | 5.9 | 2% |
| CVE-2017-1002028 | wordpress-gallery-transformation (WordPress plugin) | Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php | critical | 9.8 | 2% |
| CVE-2023-5762 | filr (WordPress plugin) | The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system | high | 8.8 | 2% |
| CVE-2015-9234 | cp-contact-form-with-paypal (WordPress plugin) | The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactform | high | 7.2 | 2% |
| CVE-2013-1759 | responsive-logo-slideshow (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary w | medium | 4.3 | 2% |
| CVE-2013-5916 | bradesco-gateway (WordPress plugin) | Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, | medium | 4.3 | 2% |
| CVE-2014-100018 | unconfirmed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2014-100027 | wp-slimstat (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2014-4570 | videowhisper-video-presentation (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Video Presentation plugin before 3.31 for WordPress allow remote att | medium | 4.3 | 2% |
| CVE-2014-6313 | woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2018-20979 | contact-form-7 (WordPress plugin) | The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type. | critical | 9.8 | 2% |
| CVE-2017-6923 | drupal/core, drupal/drupal | Missing Authorization in Drupal | medium | 6.5 | 2% |
| CVE-2019-14799 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. | medium | 6.1 | 2% |
| CVE-2021-44892 | topthink/framework | ThinkPHP Remote Code Execution (RCE) vulnerability | high | 8.8 | 2% |
| CVE-2022-3394 | wp-all-export (WordPress plugin) | The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator ro | high | 7.2 | 2% |
| CVE-2018-5776 | WordPress core | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). | medium | 6.1 | 2% |
| CVE-2014-9688 | ninja-forms (WordPress plugin) | Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admi | high | 7.5 | 2% |
| CVE-2024-22188 | typo3/cms-core | TYPO3 Install Tool vulnerable to Code Execution | high | 7.2 | 2% |
| CVE-2007-1599 | WordPress core | wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive informa | medium | 6.5 | 2% |
| CVE-2010-4481 | phpmyadmin/phpmyadmin | phpMyAdmin allows remote attackers to bypass authentication and obtain sensitive information | high | 0.0 | 2% |
| CVE-2016-10930 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number. | critical | 9.8 | 2% |
| CVE-2011-3129 | WordPress core | The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," | high | 9.3 | 2% |
| CVE-2021-36044 | magento/community-edition, magento/project-community-edition | Magento affected by a server-side denial-of-service using a GraphQL field | high | 7.5 | 2% |
| CVE-2021-36021 | magento/community-edition, magento/project-community-edition | Magento affected by remote code execution vulnerability in the CMS page scheduled update feature | critical | 9.1 | 2% |
| CVE-2019-9826 | phpbb/phpbb | phpBB Denial of Service | high | 7.5 | 2% |
| CVE-2015-5062 | silverstripe/cms, silverstripe/framework | Silverstripe CMS Open Redirect | medium | 0.0 | 2% |
| CVE-2018-10092 | dolibarr/dolibarr | Dolibarr arbitrary commands execution | high | 8.0 | 2% |
| CVE-2017-18614 | kama-clic-counter (WordPress plugin) | The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter. | high | 8.1 | 2% |
| CVE-2021-32758 | openmage/magento-lts | Layout XML Arbitrary Code Fix | high | 0.0 | 2% |
| CVE-2010-2479 | ezyang/htmlpurifier | HTML Purifier Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 2% |
| CVE-2020-12696 | iframe (WordPress plugin) | The iframe plugin before 4.5 for WordPress does not sanitize a URL. | medium | 6.1 | 2% |
| CVE-2015-5956 | typo3/cms | TYPO3 cross-site scripting (XSS) | low | 0.0 | 2% |
| CVE-2021-36917 | hide-my-wp (WordPress plugin) | WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token whi | medium | 6.5 | 2% |
| CVE-2017-9063 | WordPress core | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization s | medium | 6.1 | 2% |
| CVE-2025-3472 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due | medium | 6.5 | 2% |
| CVE-2020-35572 | vrana/adminer | vrana/adminer via XSS in the history parameter in SQL command | medium | 6.1 | 2% |
| CVE-2018-13832 | all-in-one-favicon (WordPress plugin) | Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPres | medium | 4.8 | 2% |
| CVE-2017-16955 | inlinks (WordPress plugin) | SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via | high | 8.8 | 2% |
| CVE-2019-11458 | cakephp/cakephp | Unsafe deserialization in SmtpTransport in CakePHP | high | 7.5 | 2% |
| CVE-2016-9847 | phpmyadmin/phpmyadmin | phpMyAdmin Cryptographic Vulnerability | medium | 5.3 | 2% |
| CVE-2013-2694 | wp-symposium (WordPress plugin) | Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitr | medium | 5.8 | 2% |
| CVE-2007-3238 | WordPress core | Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators t | medium | 6.0 | 2% |
| CVE-2016-10886 | wp-editor (WordPress plugin) | The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions. | critical | 9.8 | 2% |
| CVE-2019-15816 | wp-private-content-plus (WordPress plugin) | The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ | high | 7.5 | 2% |
| CVE-2023-6000 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript | medium | 6.1 | 2% |
| CVE-2017-6086 | opensolutions/vimbadmin | ViMbAdmin CSRF Vulnerabilities | high | 8.8 | 2% |
| CVE-2020-24144 | media-file-organizer (WordPress plugin) | Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files t | high | 8.6 | 2% |
| CVE-2009-3821 | apache-solr-for-typo3/solr | Apache Solr Search for TYPO3 vulnerable to Cross-site Scripting | medium | 0.0 | 2% |