Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-35749 | simple-board-job (WordPress plugin) | Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for | high | 7.7 | 30% |
| CVE-2022-26265 | contao/managed-edition | Remote Code Execution in Contao Managed Edition | critical | 9.8 | 30% |
| CVE-2022-47945 | topthink/framework | ThinkPHP Framework vulnerable to remote code execution | critical | 9.8 | 30% |
| CVE-2023-52085 | winter/wn-backend-module | Winter CMS Local File Inclusion through Server Side Template Injection | low | 3.3 | 30% |
| CVE-2019-15715 | mantisbt/mantisbt | MantisBT Remote Code Execution | high | 7.2 | 30% |
| CVE-2021-29440 | getgrav/grav | Grav's Twig processing allowing dangerous PHP functions by default | high | 8.4 | 30% |
| CVE-2021-24340 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did | high | 7.5 | 30% |
| CVE-2024-47525 | librenms/librenms | LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature | high | 7.5 | 30% |
| CVE-2023-38886 | dolibarr/dolibarr | Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script | high | 7.2 | 30% |
| CVE-2013-0235 | WordPress core | The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attack | medium | 6.4 | 30% |
| CVE-2022-4101 | images-optimize-and-upload-cf7 (WordPress plugin) | The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to u | critical | 9.1 | 29% |
| CVE-2021-39172 | cachethq/cachet | Cachet vulnerable to new line injection during configuration edition | high | 8.8 | 29% |
| CVE-2024-6366 | profile-builder (WordPress plugin) | The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media | critical | 9.1 | 29% |
| CVE-2021-44223 | WordPress core | WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via | high | 8.1 | 29% |
| CVE-2021-38314 | gutenberg-template-library-\&-redux-framework (WordPress plugin) | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated | medium | 5.3 | 29% |
| CVE-2021-24891 | website-builder (WordPress plugin) | The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, | medium | 6.1 | 29% |
| CVE-2018-12636 | better-wp-security (WordPress plugin) | The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via th | high | 7.2 | 29% |
| CVE-2016-6897 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef | medium | 6.5 | 29% |
| CVE-2023-1861 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboa | medium | 5.4 | 29% |
| CVE-2018-14058 | pimcore/pimcore | Pimcore SQLi Vulnerability | medium | 6.5 | 29% |
| CVE-2022-27115 | studio-42/elfinder | RCE in Studio-42 elFinder on Windows before 2.1.61 | critical | 9.8 | 29% |
| CVE-2023-0084 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in vers | high | 7.2 | 29% |
| CVE-2016-3109 | shopware/shopware | Shopware RCE Vulnerability | critical | 9.8 | 28% |
| CVE-2024-2340 | avada (WordPress theme) | The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-cont | medium | 5.3 | 28% |
| CVE-2007-1277 | WordPress core | WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backd | high | 7.5 | 28% |
| CVE-2020-28976 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any in | medium | 5.3 | 28% |
| CVE-2021-24209 | wp-super-cache (WordPress plugin) | The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation | high | 7.2 | 28% |
| CVE-2020-14209 | dolibarr/dolibarr | Dolibarr Unrestricted Upload of File with Dangerous Type | high | 8.8 | 27% |
| CVE-2017-1002000 | mobile-friendly-app-builder-by-easytouch (WordPress plugin) | Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch | critical | 9.8 | 27% |
| CVE-2017-16562 | userpro (WordPress plugin) | The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentic | critical | 9.8 | 27% |
| CVE-2024-5765 | wpstickybar (WordPress plugin) | The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an | critical | 9.8 | 27% |
| CVE-2017-18357 | shopware/shopware | Shopware XXE Vulnerability | medium | 6.5 | 27% |
| CVE-2019-16405 | centreon/centreon | Improper Input Validation in Centreon Web | high | 7.2 | 27% |
| CVE-2021-4119 | ssddanbrown/bookstack | BookStack is vulnerable to Improper Access Control. | medium | 5.3 | 27% |
| CVE-2022-35628 | in2code/lux | SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation" | critical | 9.8 | 27% |
| CVE-2018-20148 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMedi | critical | 9.8 | 27% |
| CVE-2017-8295 | WordPress core | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to re | medium | 5.9 | 27% |
| CVE-2024-2123 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | high | 7.2 | 27% |
| CVE-2023-5003 | active-directory-integration-\/-ldap-integration (WordPress plugin) | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an admin | high | 7.5 | 27% |
| CVE-2019-19576 | verot/class.upload.php | Remote code execution in verot/class.upload.php | critical | 9.8 | 26% |
| CVE-2021-24563 | frontend-uploader (WordPress plugin) | The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated | medium | 6.1 | 26% |
| CVE-2018-17057 | fooman/tcpdf, la-haute-societe/tcpdf, spoonity/tcpdf +3 more | TCPDF vulnerable to attackers triggering deserialization of arbitrary data | critical | 9.8 | 26% |
| CVE-2019-6703 | total-donations (WordPress plugin) | Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauth | critical | 9.8 | 26% |
| CVE-2022-1020 | woo-product-table (WordPress plugin) | The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_adm | critical | 9.8 | 26% |
| CVE-2024-6386 | wpml (WordPress plugin) | The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Templ | critical | 9.9 | 26% |
| CVE-2014-5266 | WordPress core | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the numb | medium | 5.0 | 25% |
| CVE-2022-2863 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content | medium | 4.9 | 25% |
| CVE-2020-35948 | xcloner (WordPress plugin) | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to | critical | 9.9 | 25% |
| CVE-2019-16119 | photo-gallery (WordPress plugin) | SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries | critical | 9.8 | 25% |
| CVE-2022-1952 | easync (WordPress plugin) | The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation whic | critical | 9.8 | 25% |