Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4037 | wp-photo-album-plus (WordPress plugin) | The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003 | medium | 6.5 | 0% |
| CVE-2024-4194 | album-and-image-gallery-plus-lightbox (WordPress plugin) | The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and | medium | 6.5 | 0% |
| CVE-2023-1761 | thorsten/phpmyfaq | phpMyFAQ Code Injection vulnerability | medium | 5.4 | 0% |
| CVE-2026-45697 | verbb/formie | Formie: Pre-authenticated server-side template injection in Hidden fields | critical | 9.8 | 0% |
| CVE-2026-32276 | opensource-workshop/connect-cms | Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin | high | 8.8 | 0% |
| CVE-2024-13890 | allow-php-execute (WordPress plugin) | The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to all | high | 7.2 | 0% |
| CVE-2026-100856 | azuracast/azuracast | AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field | high | 8.8 | 0% |
| CVE-2026-64850 | getgrav/grav | Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() | high | 0.0 | 0% |
| CVE-2024-10261 | paid-member-subscriptions (WordPress plugin) | The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable | high | 7.3 | 0% |
| CVE-2024-9581 | shortcodes-anywhere (WordPress plugin) | The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. Thi | high | 7.3 | 0% |
| CVE-2026-23498 | shopware/core, shopware/shopware | Shopware Has Improper Control of Generation of Code in Twig rendered views | high | 7.2 | 0% |
| CVE-2026-54133 | mtdowling/jmespath.php | jmespath.php has CompilerRuntime code injection via unescaped function names | critical | 9.8 | 0% |
| CVE-2023-1367 | alextselegidis/easyappointments | Code Injection in alextselegidis/easyappointments | high | 7.3 | 0% |
| CVE-2026-38992 | cockpit-hq/cockpit | Cockpit is vulnerable to arbitrary code execution | critical | 9.8 | 0% |
| CVE-2026-100857 | azuracast/azuracast | AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs | high | 8.7 | 0% |
| CVE-2024-13793 | wolmart (WordPress theme) | The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions | high | 7.3 | 0% |
| CVE-2024-13900 | head\,-footer\,-and-post-injections (WordPress plugin) | The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. T | medium | 4.1 | 0% |
| CVE-2026-55794 | craftcms/cms | Craft CMS: Potential authenticated Remote Code Execution via referrer redirect | high | 0.0 | 0% |
| CVE-2024-7425 | wp-all-export (WordPress plugin) | The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to i | medium | 6.8 | 0% |
| CVE-2025-62416 | bagisto/bagisto | bagisto has Server Side Template Injection (SSTI) in Product Description | medium | 5.1 | 0% |
| CVE-2026-69246 | guzzlehttp/guzzle | Guzzle: Noncanonical host can bypass host-based checks | high | 7.2 | 0% |
| CVE-2026-67355 | guzzlehttp/guzzle | Guzzle: Host-only cookie scope is not preserved | medium | 5.9 | 0% |
| CVE-2025-4208 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all vers | medium | 6.3 | 0% |
| CVE-2026-33043 | wwbn/avideo | AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS | high | 8.1 | 0% |
| CVE-2024-10970 | motors-car-dealership-classified-listings (WordPress plugin) | The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to | medium | 5.4 | 0% |
| CVE-2026-34973 | thorsten/phpmyfaq | phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure | medium | 5.3 | 0% |
| CVE-2026-41056 | wwbn/avideo | WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover | high | 8.1 | 0% |
| CVE-2023-6494 | woo-smart-quick-view (WordPress plugin) | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all version | medium | 4.4 | 0% |
| CVE-2026-25125 | october/rain | October Rain has Environment Variable Exfiltration via INI Parser Interpolation | medium | 4.9 | 0% |
| CVE-2025-3422 | everest-forms (WordPress plugin) | The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to ar | medium | 5.4 | 0% |
| CVE-2026-69088 | getgrav/grav | Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure | high | 8.1 | 0% |
| CVE-2026-43874 | wwbn/avideo | AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Rela | high | 7.2 | 0% |
| CVE-2025-67509 | neuron-core/neuron-ai | Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE) | high | 8.2 | 0% |
| CVE-2026-43880 | wwbn/avideo | AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address | medium | 5.3 | 0% |
| CVE-2024-13895 | code-snippets-cpt (WordPress plugin) | The The Code Snippets CPT plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.0. T | medium | 4.3 | 0% |
| CVE-2026-31018 | dolibarr/dolibarr | Dolibarr Allows Code Injection through its Website Module | high | 8.8 | 0% |
| CVE-2024-13420 | april (WordPress plugin), auteur (WordPress plugin), benaa (WordPress plugin) +1 more | Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions | medium | 4.3 | 0% |
| CVE-2026-42879 | facturascripts/facturascripts | FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images | medium | 6.3 | 0% |
| CVE-2026-31825 | sylius/sylius | Sylius has a DQL Injection via API Order Filters | medium | 5.3 | 0% |
| GHSA-67wg-6j7r-mqh8 | typo3/cms | Arbitrary Code Execution in TYPO3 CMS | critical | 9.9 | – |
| GHSA-7qwg-fcpw-xg5g | typo3/cms | Privilege Escalation & SQL Injection in TYPO3 CMS | high | 8.8 | – |
| CVE-2014-6072 | symfony/symfony, symfony/web-profiler-bundle | Symfony Cross-Site Request Forgery vulnerability in the Web Profiler | high | 8.1 | – |
| GHSA-gxxj-g9v8-w28p | drupal/core | Drupal core Arbitrary PHP code execution | high | 7.8 | – |
| GHSA-j66p-fvp2-fxhj | drupal/drupal | Drupal core Arbitrary PHP code execution | high | 7.8 | – |
| CVE-2014-4931 | symfony/framework-bundle, symfony/symfony | Code injection in the way Symfony implements translation caching in FrameworkBundle | high | 7.5 | – |
| GHSA-2ffv-r4r9-r8xr | illuminate/cookie | Laravel RCE vulnerability in "cookie" session driver | critical | 0.0 | – |
| GHSA-2w9p-xxqr-h253 | ezsystems/ezplatform-kernel | eZ Platform Object Injection in SiteAccessMatchListener | high | 0.0 | – |
| GHSA-39j2-4p9j-5w4j | ezsystems/ezpublish-legacy | Ez Platform Object Injection in legacy shop module | medium | 0.0 | – |
| GHSA-3vwr-jj4f-h98x | ezsystems/ezpublish-kernel | eZ Publish Remote code execution in file uploads | high | 0.0 | – |
| GHSA-64vj-933f-6pm3 | ezsystems/ezpublish-kernel | eZ Platform Object Injection in SiteAccessMatchListener | high | 0.0 | – |