Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-10762 | camptix (WordPress plugin) | The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used. | high | 7.5 | 2% |
| CVE-2011-4340 | symphonycms/symphony-2 | Symphony CMS vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2019-11843 | mailpoet (WordPress plugin) | The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the | medium | 6.1 | 2% |
| CVE-2022-34858 | oauth-2.0-client-for-sso (WordPress plugin) | Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress. | critical | 9.8 | 2% |
| CVE-2014-10379 | duplicate-post (WordPress plugin) | The duplicate-post plugin before 2.6 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2014-10387 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9330 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9335 | limit-attempts (WordPress plugin) | The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling. | critical | 9.8 | 2% |
| CVE-2015-9344 | link-log (WordPress plugin) | The link-log plugin before 2.1 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9352 | wp-polls (WordPress plugin) | The wp-polls plugin before 2.72 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2016-10909 | booking-calendar-contact-form (WordPress plugin) | The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2017-6955 | invite-anyone (WordPress plugin) | An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subje | medium | 5.3 | 2% |
| CVE-2021-38324 | sp-rental-manager (WordPress plugin) | The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the ~/user/shortcodes.php file whic | high | 8.2 | 2% |
| CVE-2023-5822 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient fil | high | 8.1 | 2% |
| CVE-2009-0256 | typo3/cms | Authentication library in TYPO3 vulnerable to session fixation | high | 0.0 | 2% |
| CVE-2012-5888 | b13/seo_basics | Basic SEO Features (seo_basics) extension TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2016-9861 | phpmyadmin/phpmyadmin | phpMyAdmin Bypass white-list protection for URL redirection | high | 7.5 | 2% |
| CVE-2016-0770 | connections (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for Wo | medium | 6.1 | 2% |
| CVE-2018-16308 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. | high | 8.6 | 2% |
| CVE-2020-15099 | typo3/cms, typo3/cms-core | Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS | high | 8.1 | 2% |
| CVE-2022-1170 | jobmonster (WordPress plugin) | In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided th | medium | 6.1 | 2% |
| CVE-2022-2436 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versi | high | 8.8 | 2% |
| CVE-2022-21686 | prestashop/prestashop | Server Side Twig Template Injection | critical | 9.0 | 2% |
| CVE-2022-0836 | sema-api (WordPress plugin) | The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an A | critical | 9.8 | 2% |
| CVE-2022-4774 | bit-form (WordPress plugin) | The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated | critical | 9.8 | 2% |
| CVE-2021-36038 | magento/community-edition, magento/project-community-edition | Magento discloses sensitive information via the Multishipping Module | medium | 6.5 | 2% |
| CVE-2015-7666 | payment-form-for-paypal-pro (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_i | medium | 6.1 | 2% |
| CVE-2015-8834 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web | medium | 6.1 | 2% |
| CVE-2007-3241 | WordPress core | Cross-site scripting (XSS) vulnerability in blogroll.php in the cordobo-green-park theme for WordPress allows remote attackers to inject arb | medium | 4.3 | 2% |
| CVE-2018-12581 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2020-21322 | feehi/cms | Arbitrary Code Execution in feehi/cms | high | 0.0 | 2% |
| CVE-2021-28584 | magento/community-edition, magento/project-community-edition | Magento Path Traversal vulnerability | medium | 5.4 | 2% |
| CVE-2014-10376 | i-recommend-this (WordPress plugin) | The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2017-18570 | cforms2 (WordPress plugin) | The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries. | critical | 9.8 | 2% |
| CVE-2017-18571 | search-everything (WordPress plugin) | The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-201 | critical | 9.8 | 2% |
| CVE-2019-15025 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page. | critical | 9.8 | 2% |
| CVE-2019-15330 | webp-express (WordPress plugin) | The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading. | high | 7.5 | 2% |
| CVE-2013-1939 | sabre/dav | SabreDAV Directory Traversal vulnerability | medium | 0.0 | 2% |
| CVE-2019-7892 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability via SSRF | high | 7.2 | 2% |
| CVE-2021-24311 | external-media (WordPress plugin) | The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via | high | 8.8 | 2% |
| CVE-2017-9062 | WordPress core | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. | high | 8.6 | 2% |
| CVE-2022-2438 | broken-link-checker (WordPress plugin) | The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to | high | 7.2 | 2% |
| CVE-2017-16754 | bolt/bolt | Bolt Improper Access Control | medium | 5.3 | 2% |
| CVE-2023-6036 | web3---crypto-wallet-login-\&-nft-token-gating (WordPress plugin) | The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow | critical | 9.8 | 2% |
| CVE-2016-4828 | welcart-e-commerce (WordPress plugin) | The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by lever | medium | 6.5 | 2% |
| CVE-2019-19589 | pdf-embedder (WordPress plugin) | The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: | critical | 9.8 | 2% |
| CVE-2026-44177 | getkirby/cms | Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup | high | 0.0 | 2% |
| CVE-2007-3544 | WordPress core | Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticat | medium | 6.5 | 2% |
| CVE-2022-21829 | concrete5/core | Code injection in concrete CMS | high | 8.0 | 2% |
| CVE-2022-1946 | gallery (WordPress plugin) | The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX acti | medium | 6.1 | 2% |