Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-42356 | shopware/core, shopware/platform | Shopware vulnerable to Server Side Template Injection in Twig using Context functions | high | 8.3 | 1% |
| CVE-2024-8623 | wp-meta-data-filter-and-taxonomy-filter (WordPress plugin) | The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an | high | 7.3 | 1% |
| CVE-2026-40911 | wwbn/avideo | WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks | critical | 10.0 | 1% |
| CVE-2026-26045 | moodle/moodle | Moodle has a Remote Code Execution risk via file restore | high | 7.2 | 1% |
| CVE-2026-46640 | twig/twig | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation | high | 0.0 | 1% |
| CVE-2024-3562 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop cus | high | 8.8 | 1% |
| CVE-2024-8478 | amazonsimpleadmin (WordPress plugin) | The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, | high | 7.3 | 1% |
| CVE-2023-0792 | thorsten/phpmyfaq | Code Injection in thorsten/phpmyfaq | medium | 5.4 | 1% |
| CVE-2026-28695 | craftcms/cms | Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget | medium | 0.0 | 1% |
| CVE-2024-7419 | wp-all-export (WordPress plugin) | The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom | high | 8.3 | 1% |
| CVE-2024-13499 | gamipress (WordPress plugin) | The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to ar | high | 7.3 | 1% |
| CVE-2025-1509 | show-me-the-cookies (WordPress plugin) | The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. T | high | 7.3 | 1% |
| CVE-2025-52122 | solspace/craft-freeform | The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability | critical | 9.8 | 1% |
| CVE-2025-66299 | getgrav/grav | Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection) | high | 8.8 | 1% |
| CVE-2024-10899 | wc-product-table-lite (WordPress plugin) | The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includ | high | 7.3 | 1% |
| CVE-2023-2591 | nilsteampassnet/teampass | teampass vulnerable to code injection | high | 7.1 | 1% |
| CVE-2024-11038 | wpb-popup-for-contact-form-7 (WordPress plugin) | The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to ar | high | 7.3 | 1% |
| CVE-2024-11002 | inpost-gallery (WordPress plugin) | The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJA | medium | 6.3 | 1% |
| CVE-2024-13495 | gamipress (WordPress plugin) | The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to ar | high | 7.3 | 1% |
| CVE-2025-67847 | moodle/moodle | Moodle affected by a code injection vulnerability | high | 8.8 | 1% |
| CVE-2026-36340 | krayin/laravel-crm | Krayin CRM allows a remote attacker to execute arbitrary code via compose email function | high | 8.1 | 1% |
| CVE-2024-8479 | simple-spoiler (WordPress plugin) | The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin | high | 7.3 | 1% |
| CVE-2024-9846 | enable-shortcodes-inside-widgetscomments-and-experts (WordPress plugin) | The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver | high | 7.3 | 1% |
| CVE-2023-41005 | pagekit/pagekit | Command injection in pagekit | high | 7.8 | 1% |
| CVE-2024-13472 | wc-product-table-lite (WordPress plugin) | The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includ | high | 7.3 | 1% |
| CVE-2024-28593 | moodle/moodle | Cross-site Scripting in Moodle Chat | medium | 5.4 | 1% |
| CVE-2026-41249 | coreshop/core-shop | CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration | high | 8.2 | 1% |
| CVE-2024-13792 | woocommerce-food (WordPress plugin) | The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions u | high | 7.3 | 1% |
| CVE-2024-13797 | pressmart (WordPress theme) | The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versi | high | 7.3 | 1% |
| CVE-2024-13345 | avada-builder (WordPress plugin) | The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is | high | 7.3 | 1% |
| CVE-2026-59989 | phalcon/cphalcon | Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) | critical | 0.0 | 1% |
| CVE-2026-33479 | wwbn/avideo | AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin | high | 8.8 | 1% |
| CVE-2026-25513 | facturascripts/facturascripts | FacturaScripts has SQL Injection in API ORDER BY Clause | high | 0.0 | 1% |
| CVE-2023-4977 | librenms/librenms | LibreNMS Code Injection vulnerability | medium | 5.4 | 1% |
| CVE-2026-25514 | facturascripts/facturascripts | FacturaScripts has SQL Injection in Autocomplete Actions | high | 0.0 | 1% |
| CVE-2024-13814 | global-gallery (WordPress plugin) | The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up | medium | 5.4 | 1% |
| CVE-2024-57601 | alextselegidis/easyappointments | Remote code execution in alextselegidis/easyappointments | medium | 6.1 | 1% |
| CVE-2024-10263 | tickera-event-ticketing-system (WordPress plugin) | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inclu | high | 7.3 | 1% |
| CVE-2023-44381 | october/system | October CMS safe mode bypass using Page template injection | medium | 4.9 | 1% |
| CVE-2024-35226 | smarty/smarty | Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag | high | 7.3 | 1% |
| CVE-2025-56588 | dolibarr/dolibarr | Dolibarr vulnerable to RCE via the computed field parameter | high | 8.8 | 1% |
| CVE-2025-54417 | craftcms/cms | Craft CMS has a theoretical bypass for CVE-2025-23209 | medium | 0.0 | 0% |
| CVE-2026-28425 | statamic/cms | Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs | high | 8.0 | 0% |
| CVE-2025-65854 | mineadmin/mineadmin | MineAdmin has an insecure default password | critical | 9.8 | 0% |
| CVE-2024-8254 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | medium | 5.4 | 0% |
| CVE-2024-12238 | ninja-forms (WordPress plugin) | The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in al | medium | 6.3 | 0% |
| CVE-2026-81525 | mongodb/mongodb | mongodb: Reject "." and NUL bytes in database and collection names | high | 8.1 | 0% |
| CVE-2025-6744 | woodmart (WordPress theme) | The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due | high | 7.3 | 0% |
| CVE-2026-28783 | craftcms/cms | Craft CMS has Twig Function Blocklist Bypass | medium | 0.0 | 0% |
| CVE-2026-41229 | froxlor/froxlor | Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) | critical | 9.1 | 0% |