Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2557 | team---wordpress-team-members-showcase (WordPress plugin) | The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server | high | 8.8 | 2% |
| CVE-2017-16871 | updraftplus (WordPress plugin) | The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/pl | high | 8.1 | 2% |
| CVE-2021-24123 | powerpress (WordPress plugin) | Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as th | high | 7.2 | 2% |
| CVE-2019-17207 | broken-link-checker (WordPress plugin) | A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11 | medium | 5.4 | 2% |
| CVE-2011-4628 | typo3/cms | Typo3 Authentication Bypass | critical | 9.8 | 2% |
| CVE-2023-0477 | auto-featured-image (WordPress plugin) | The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Au | high | 8.8 | 2% |
| CVE-2025-0366 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, | high | 8.8 | 2% |
| CVE-2016-10991 | imdb-widget (WordPress plugin) | The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion. | high | 7.5 | 2% |
| CVE-2022-0250 | redirection-for-contact-form-7 (WordPress plugin) | The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, lead | medium | 6.1 | 2% |
| CVE-2023-1880 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter | high | 8.3 | 2% |
| CVE-2024-10958 | wp-photo-album-plus (WordPress plugin) | The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX acti | high | 7.3 | 2% |
| CVE-2020-18325 | intelliants/subrion | Cross-site Scripting in intelliants/subrion | medium | 6.1 | 2% |
| CVE-2021-21424 | lexik/jwt-authentication-bundle, symfony/maker-bundle, symfony/security +4 more | Prevent user enumeration using Guard or the new Authenticator-based Security | medium | 5.3 | 2% |
| CVE-2019-15537 | cesnet/simplesamlphp-module-proxystatistics | SQL Injection in SimpleSAMLphp | critical | 9.8 | 2% |
| CVE-2022-3125 | frontend-file-manager (WordPress plugin) | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arb | high | 8.8 | 2% |
| CVE-2021-24165 | ninja-forms (WordPress plugin) | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due | medium | 6.1 | 2% |
| CVE-2015-3907 | chriskacerguis/codeigniter-restserver | CodeIgniter Rest Server XXE Vulnerability | critical | 9.8 | 2% |
| CVE-2022-0768 | rudloff/alltube | Server-Side Request Forgery (SSRF) in rudloff/alltube | critical | 9.1 | 2% |
| CVE-2014-2839 | gd-star-rating (WordPress plugin) | SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands | high | 7.5 | 2% |
| CVE-2020-9019 | wpjobboard (WordPress plugin) | The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description. | medium | 6.1 | 2% |
| CVE-2016-10148 | WordPress core | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checkin | medium | 4.3 | 2% |
| CVE-2021-24651 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. Whil | high | 7.5 | 2% |
| CVE-2013-7078 | typo3/cms-core | TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework | low | 0.0 | 2% |
| CVE-2024-13609 | 1-click-migration (WordPress plugin) | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure i | medium | 5.9 | 2% |
| CVE-2017-18604 | sitebuilder-dynamic-components (WordPress plugin) | The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request. | high | 7.5 | 2% |
| CVE-2022-3380 | customizer-export\/import (WordPress plugin) | The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object inje | high | 7.2 | 2% |
| CVE-2014-4521 | dsidxpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attacker | medium | 4.3 | 2% |
| CVE-2014-4532 | garagesale (WordPress plugin) | Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress | medium | 4.3 | 2% |
| CVE-2014-4597 | wp-social-invitations (WordPress plugin) | Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations plugin before 1.4.4.3 for WordPress allows remote attacker | medium | 4.3 | 2% |
| CVE-2016-5704 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2016-5732 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2014-4017 | conversion-ninja (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Conversion Ninja plugin for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2016-2040 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 5.4 | 2% |
| CVE-2014-3945 | typo3/cms | TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash | critical | 0.0 | 2% |
| CVE-2020-5780 | email-subscribers-\&-newsletters (WordPress plugin) | Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a | medium | 5.3 | 2% |
| CVE-2014-3942 | typo3/cms | TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code | high | 0.0 | 2% |
| CVE-2018-8092 | mautic/core | CSV Injection vulnerability with exported contact lists in Mautic | critical | 9.8 | 2% |
| CVE-2024-8277 | woocommerce-photo-reviews (WordPress plugin) | The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3. | critical | 9.8 | 2% |
| CVE-2022-2594 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated | high | 8.8 | 2% |
| CVE-2014-10012 | awp-classifieds (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-3870 | bib2html (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the bib2html plugin 0.9.3 for WordPress allows remote attackers to inject arbitrary web script o | medium | 4.3 | 2% |
| CVE-2014-3921 | simple-popup (WordPress plugin) | Cross-site scripting (XSS) vulnerability in popup.php in the Simple Popup Images plugin for WordPress allows remote attackers to inject arbi | medium | 4.3 | 2% |
| CVE-2014-4724 | custom-banners (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web | medium | 4.3 | 2% |
| CVE-2014-8364 | wordpress-spreadsheet-plugin (WordPress plugin) | Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attac | medium | 4.3 | 2% |
| CVE-2014-8955 | clean-and-simple-contact-form (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) plugin 4.4.0 a | medium | 4.3 | 2% |
| CVE-2014-9100 | whydowork-adsense (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2014-9453 | simple-visitor-stat (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in simple-visitor-stat.php in the Simple visitor stat plugin for WordPress allow remote | medium | 4.3 | 2% |
| CVE-2015-2040 | contact-form-db (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPr | medium | 4.3 | 2% |
| CVE-2018-0572 | baserproject/basercms | baserCMS vulnerable to Access Control Bypass | high | 8.1 | 2% |
| CVE-2021-21355 | typo3/cms, typo3/cms-core, typo3/cms-form | Unrestricted File Upload in Form Framework | high | 8.6 | 2% |