Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-16738 | mediawiki/core | MediaWiki information disclosure | medium | 5.3 | 2% |
| CVE-2015-8766 | symphonycms/symphony-2 | Symphony CMS XSS Vulnerabilities | medium | 6.1 | 2% |
| CVE-2019-16221 | WordPress core | WordPress before 5.2.3 allows reflected XSS in the dashboard. | medium | 6.1 | 2% |
| CVE-2017-10842 | baserproject/basercms | baserCMS SQL Injection vulnerability | critical | 9.8 | 2% |
| CVE-2020-4040 | bolt/bolt | CSRF issue on preview pages in Bolt CMS | high | 8.6 | 2% |
| CVE-2015-3299 | floating-social-bar (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbi | medium | 6.1 | 2% |
| CVE-2019-17672 | WordPress core | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. | medium | 6.1 | 2% |
| CVE-2016-11006 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes. | medium | 5.3 | 2% |
| CVE-2016-11008 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates. | medium | 5.3 | 2% |
| CVE-2016-11009 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates. | medium | 5.3 | 2% |
| CVE-2016-11010 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates. | medium | 5.3 | 2% |
| CVE-2013-2200 | WordPress core | WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restric | medium | 4.0 | 2% |
| CVE-2018-19281 | centreon/centreon | Centreon allows SNMP trap SQL Injection | critical | 9.8 | 2% |
| CVE-2020-10817 | custom-searchable-data-entry-system (WordPress plugin) | The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. N | high | 8.8 | 2% |
| CVE-2013-5739 | WordPress core | The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote a | low | 3.5 | 2% |
| CVE-2023-2601 | wp-brutal-ai (WordPress plugin) | The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading t | critical | 9.8 | 2% |
| CVE-2019-14467 | social-photo-gallery (WordPress plugin) | The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in th | high | 7.8 | 2% |
| CVE-2022-0234 | woocs (WordPress plugin) | The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price | medium | 6.1 | 2% |
| CVE-2012-6635 | WordPress core | wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remot | medium | 4.0 | 2% |
| CVE-2026-30849 | mantisbt/mantisbt | MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL | critical | 0.0 | 2% |
| CVE-2021-24229 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon W | critical | 9.6 | 2% |
| CVE-2017-18528 | pdf-print (WordPress plugin) | The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2015-9458 | searchterms-tagging-2 (WordPress plugin) | The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploita | high | 7.2 | 2% |
| CVE-2014-9442 | cart66-lite (WordPress plugin) | SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users | medium | 6.5 | 2% |
| CVE-2017-5488 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject a | medium | 6.1 | 2% |
| CVE-2024-13322 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' paramete | high | 7.5 | 2% |
| CVE-2016-5731 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site scripting (XSS) vulnerability | medium | 6.1 | 2% |
| CVE-2017-7897 | mantisbt/mantisbt | MantisBT XSS via my_view_page.php and view_user_page.php | medium | 6.1 | 2% |
| CVE-2019-15929 | craftcms/cms | Craft CMS possibility of brute force attempts | critical | 9.8 | 2% |
| CVE-2022-34026 | icecoder/icecoder | ICEcoder vulnerable to Path Traversal | high | 7.5 | 2% |
| CVE-2021-41129 | pterodactyl/panel | Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification | high | 8.1 | 2% |
| CVE-2025-7340 | ht-contactform (WordPress plugin) | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file | critical | 9.8 | 2% |
| CVE-2019-9553 | bolt/bolt | Bolt Cross-site Scripting via the slug, teaser or title parameters | medium | 6.1 | 2% |
| CVE-2023-6449 | contact-form-7 (WordPress plugin) | The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' f | medium | 6.6 | 2% |
| CVE-2022-0657 | 5-stars-rating-funnel (WordPress plugin) | The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead id | critical | 9.8 | 2% |
| CVE-2022-0782 | donations (WordPress plugin) | The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via | critical | 9.8 | 2% |
| CVE-2024-2662 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versio | high | 7.2 | 2% |
| CVE-2021-24233 | cooked (WordPress plugin) | The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper saniti | medium | 6.1 | 2% |
| CVE-2014-3551 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | low | 0.0 | 2% |
| CVE-2022-0895 | microweber/microweber | Static Code Injection in Microweber | high | 7.7 | 2% |
| CVE-2021-21265 | october/backend | October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers | low | 0.0 | 2% |
| CVE-2017-7886 | dolibarr/dolibarr | Dolibarr SQL Injection in doli/theme/eldy/style.css.php via the lang parameter | critical | 9.8 | 2% |
| CVE-2021-36039 | magento/community-edition, magento/project-community-edition | Magento discloses sensitive information | medium | 6.5 | 2% |
| CVE-2021-27367 | bolt/core | Path traversal in bolt/core | high | 0.0 | 2% |
| CVE-2014-2558 | file-gallery (WordPress plugin) | The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitra | medium | 6.5 | 2% |
| CVE-2022-25812 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high priv | high | 7.2 | 2% |
| CVE-2024-7786 | sensei-lms (WordPress plugin) | The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to lea | medium | 5.3 | 2% |
| CVE-2018-20981 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data req | critical | 9.1 | 2% |
| CVE-2020-20625 | sliced-invoices (WordPress plugin) | Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via cor | high | 7.5 | 2% |
| CVE-2026-24421 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) | medium | 6.5 | 2% |