Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-9879 | wpgraphql (WordPress plugin) | The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registratio | critical | 9.8 | 46% |
| CVE-2019-13344 | wp-like-button (WordPress plugin) | An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to | medium | 5.3 | 45% |
| CVE-2023-2114 | nex-forms (WordPress plugin) | The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concate | high | 7.2 | 45% |
| CVE-2024-52301 | laravel/framework | Laravel environment manipulation via query string | high | 0.0 | 45% |
| CVE-2019-13635 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal. | critical | 9.1 | 44% |
| CVE-2018-16299 | localize-my-post (WordPress plugin) | The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. | high | 7.5 | 44% |
| CVE-2022-0666 | microweber/microweber | CRLF Injection in microweber | high | 7.6 | 44% |
| CVE-2022-3062 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflect | medium | 6.1 | 44% |
| CVE-2022-0332 | moodle/moodle | SQL injection in Moodle | critical | 9.8 | 44% |
| CVE-2020-13693 | bbpress (WordPress plugin), bbpress/bbpress | An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. | critical | 9.8 | 44% |
| CVE-2022-0479 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a S | critical | 9.8 | 44% |
| CVE-2019-9618 | gracemedia-media-player (WordPress plugin) | The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter. | critical | 9.8 | 44% |
| CVE-2016-10074 | swiftmailer/swiftmailer | Swift Mailer mail transport Command Injection | critical | 9.8 | 44% |
| CVE-2022-0482 | alextselegidis/easyappointments | Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments | critical | 9.1 | 44% |
| CVE-2020-36847 | simple-file-list (WordPress plugin) | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename func | critical | 9.8 | 44% |
| CVE-2022-1281 | photo-gallery (WordPress plugin) | The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL qu | critical | 9.8 | 43% |
| CVE-2019-14314 | nextgen-gallery (WordPress plugin) | A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vuln | critical | 9.8 | 43% |
| CVE-2022-0773 | documentor (WordPress plugin) | The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement an | critical | 9.8 | 43% |
| CVE-2023-0448 | wp-helper-premium (WordPress plugin) | The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cro | medium | 6.1 | 43% |
| CVE-2021-43421 | studio-42/elfinder | elFinder Unrestricted File Upload vulnerability | critical | 9.8 | 43% |
| CVE-2022-4060 | user-post-gallery (WordPress plugin) | The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any | critical | 9.8 | 43% |
| CVE-2022-0819 | dolibarr/dolibarr | Code injection in dolibarr/dolibarr | high | 8.8 | 43% |
| CVE-2023-2796 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthent | medium | 5.3 | 43% |
| CVE-2023-2986 | woocommerce-abandoned-cart (WordPress plugin) | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2 | critical | 9.8 | 43% |
| CVE-2025-4380 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions | high | 8.1 | 43% |
| CVE-2025-1128 | everest-forms (WordPress plugin) | The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbit | critical | 9.8 | 42% |
| CVE-2009-0815 | typo3/cms | TYPO3 leaks a hash secret in an error message | medium | 0.0 | 42% |
| CVE-2023-28662 | gift-vouchers (WordPress plugin) | The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerabilit | critical | 9.8 | 42% |
| CVE-2021-24284 | kaswara (WordPress plugin) | The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX actio | critical | 9.8 | 42% |
| CVE-2018-3811 | smart-google-code-inserter (WordPress plugin) | SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to exe | critical | 9.8 | 42% |
| CVE-2013-3630 | moodle/moodle | Moodle Authenticated Spelling Binary Remote Code Execution | medium | 0.0 | 42% |
| CVE-2024-3054 | wpvivid-backuprestore (WordPress plugin) | WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deser | high | 7.2 | 42% |
| CVE-2024-50352 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php | high | 7.5 | 41% |
| CVE-2020-24913 | qcubed/qcubed | qcubed SQL injection vulnerability in profile.php via the strQuery parameter | critical | 9.8 | 41% |
| CVE-2023-4521 | import-xml-and-rss-feeds (WordPress plugin) | The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plug | critical | 9.8 | 41% |
| CVE-2015-4455 | aviary-image-editor-add-on-for-gravity-forms (WordPress plugin) | Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPr | critical | 9.8 | 41% |
| CVE-2023-1730 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allo | critical | 9.8 | 41% |
| CVE-2022-0661 | ad-injection (WordPress plugin) | The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a hi | high | 7.2 | 40% |
| CVE-2015-2065 | contus-video-gallery (WordPress plugin) | SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPr | high | 7.5 | 40% |
| CVE-2021-32671 | flarum/core | XSS vulnerability with translator | critical | 10.0 | 40% |
| CVE-2023-6505 | prime-mover (WordPress plugin) | The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing | high | 7.5 | 40% |
| CVE-2023-2068 | file-manager-advanced-shortcode (WordPress plugin) | The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types wh | critical | 9.8 | 40% |
| CVE-2022-0888 | ninja-forms-file-uploads (WordPress plugin) | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type valida | critical | 9.8 | 39% |
| CVE-2014-2383 | dompdf/dompdf | DOMPDF Arbitrary File Read | medium | 0.0 | 39% |
| CVE-2024-10728 | ultimate-post (WordPress plugin) | The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/acti | high | 8.8 | 39% |
| CVE-2022-2754 | ketchup-restaurant-reservations (WordPress plugin) | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using the | critical | 9.8 | 39% |
| CVE-2020-5504 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection in user accounts page | high | 8.8 | 39% |
| CVE-2019-16932 | visualizer (WordPress plugin) | A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data. | critical | 10.0 | 39% |
| CVE-2005-2612 | WordPress core | Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_las | high | 7.5 | 39% |
| CVE-2022-4305 | login-as-user-or-customer-\(user-switching\) (WordPress plugin) | The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another o | critical | 9.8 | 39% |