Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-9787 | WordPress core | WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default conf | high | 8.8 | 39% |
| CVE-2015-2067 | dweeves/magmi | MAGMI plugin for Magento Server Directory Traversal | medium | 0.0 | 38% |
| CVE-2016-10034 | zendframework/zend-mail | zend-mail remote code execution via Sendmail adapter | critical | 9.8 | 38% |
| CVE-2021-24750 | visitor-statistics (WordPress plugin) | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails | high | 8.8 | 38% |
| CVE-2022-4732 | microweber/microweber | Microweber vulnerable to unrestricted malicious uploads | high | 7.2 | 38% |
| CVE-2016-6896 | WordPress core | Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remo | high | 7.1 | 38% |
| CVE-2018-14009 | codiad/codiad | Codiad remote code execution vulnerability | critical | 9.8 | 38% |
| CVE-2024-3097 | nextgen-gallery (WordPress plugin) | The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability | medium | 5.3 | 38% |
| CVE-2024-0235 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unaut | medium | 5.3 | 38% |
| CVE-2022-21647 | codeigniter4/framework | Deserialization of Untrusted Data in Codeigniter4 | high | 7.7 | 38% |
| CVE-2022-4068 | librenms/librenms | Cross-site Scripting in librenms/librenms | high | 7.6 | 38% |
| CVE-2022-0739 | bookingpress (WordPress plugin) | The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constr | critical | 9.8 | 37% |
| CVE-2022-39987 | billz/raspap-webgui | RaspAP Command Injection vulnerability | high | 8.8 | 37% |
| CVE-2022-1905 | events-made-easy (WordPress plugin) | The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via | critical | 9.8 | 37% |
| CVE-2015-8351 | gwolle-gb (WordPress plugin) | PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows | critical | 9.0 | 37% |
| CVE-2024-4434 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions | critical | 9.8 | 37% |
| CVE-2021-3120 | yith-woocommerce-gift-cards (WordPress plugin) | An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers | critical | 9.8 | 37% |
| CVE-2025-0370 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in | medium | 6.4 | 37% |
| CVE-2019-17671 | WordPress core | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. | medium | 5.3 | 37% |
| CVE-2023-27159 | appwrite/server-ce | Appwrite Server-Side Request Forgery vulnerability | high | 7.5 | 36% |
| CVE-2019-6339 | drupal/core, drupal/drupal | A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an | critical | 9.8 | 36% |
| CVE-2023-4197 | dolibarr/dolibarr | Dolibarr Improper Input Validation vulnerability | high | 7.5 | 36% |
| CVE-2022-4230 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection | high | 8.8 | 36% |
| CVE-2024-6220 | keydatas (WordPress plugin) | The 简数采集器 (Keydatas) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the keydatas_downlo | critical | 9.8 | 35% |
| CVE-2019-9880 | wpgraphql (WordPress plugin) | An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticat | critical | 9.1 | 35% |
| CVE-2024-10470 | wordpress-learning-management-system (WordPress theme) | The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due | critical | 9.8 | 35% |
| CVE-2022-40871 | dolibarr/dolibarr | Dolibarr vulnerable to Eval Injection | critical | 9.8 | 35% |
| CVE-2024-5315 | dolibarr/dolibarr | Dolibarr vulnerable to SQL Injection | critical | 9.1 | 35% |
| CVE-2020-15227 | nette/application, nette/nette | Potential Remote Code Execution vulnerability | high | 8.7 | 34% |
| CVE-2022-0349 | notificationx (WordPress plugin) | The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading | critical | 9.8 | 34% |
| CVE-2023-1650 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, whi | critical | 9.8 | 34% |
| CVE-2024-1651 | torrentpier/torrentpier | Deserialization of Untrusted Data in Torrentpier | critical | 10.0 | 34% |
| CVE-2024-32479 | librenms/librenms | LibreNMS uses Improper Sanitization on Service template name leads to Stored XSS | high | 7.1 | 34% |
| CVE-2022-2633 | all-in-one-video-gallery (WordPress plugin) | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'd | high | 7.5 | 34% |
| CVE-2019-18889 | symfony/cache, symfony/symfony | Symfony Unsafe Cache Serialization Could Enable RCE | critical | 9.8 | 33% |
| CVE-2015-1376 | pixabay-images (WordPress plugin) | pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated user | medium | 4.0 | 33% |
| CVE-2018-19458 | athlon1600/php-proxy-app | Unauthenticated File Read in PHP Proxy | high | 7.5 | 33% |
| CVE-2018-14716 | nystudio107/craft-seomatic | SEOmatic plugin for Craft CMS SSTI Vulnerability | high | 7.5 | 33% |
| CVE-2015-5471 | swim-team (WordPress plugin) | Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers | medium | 5.3 | 32% |
| CVE-2023-0157 | all-in-one-security (WordPress plugin) | The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin adm | medium | 4.8 | 32% |
| CVE-2024-8353 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | critical | 9.8 | 32% |
| CVE-2022-0651 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type | critical | 9.8 | 32% |
| CVE-2025-23200 | librenms/librenms | LibreNMS Misc Section Stored Cross-site Scripting vulnerability | medium | 4.6 | 32% |
| CVE-2023-38874 | gugoan/economizzer | Economizzer remote code execution vulnerability | high | 8.8 | 32% |
| CVE-2018-1133 | moodle/moodle | Moodle calculated question type allows remote code execution by Question authors | high | 8.8 | 31% |
| CVE-2021-24146 | modern-events-calendar-lite (WordPress plugin) | Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access t | high | 7.5 | 31% |
| CVE-2023-6114 | duplicator (WordPress plugin) | The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-l | high | 7.5 | 31% |
| CVE-2020-29045 | food-and-drink-menu (WordPress plugin) | The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize opera | critical | 9.8 | 31% |
| CVE-2023-7002 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' p | high | 7.2 | 31% |
| CVE-2024-55661 | laravel/pulse | Laravel Pulse Allows Remote Code Execution via Unprotected Query Method | high | 0.0 | 31% |