Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0552 | pie-register (WordPress plugin) | The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading | medium | 5.4 | 24% |
| CVE-2021-21809 | moodle/moodle | Moodle command execution vulnerability exists in the default legacy spellchecker plugin | critical | 9.1 | 24% |
| CVE-2010-3714 | typo3/cms | TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism | high | 0.0 | 24% |
| CVE-2015-5468 | wp-ecommerce-shop-styling (WordPress plugin) | Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrar | high | 7.5 | 24% |
| CVE-2023-2916 | iwp-client (WordPress plugin) | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the | high | 7.5 | 24% |
| CVE-2022-33107 | topthink/framework | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | 24% |
| CVE-2022-0863 | wp-svg-icons (WordPress plugin) | The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like | high | 7.2 | 24% |
| CVE-2023-45363 | mediawiki/core | MediaWiki Denial of Service vulnerability | high | 7.5 | 24% |
| CVE-2023-5591 | librenms/librenms | SQL injection in librenms/librenms | high | 7.8 | 24% |
| CVE-2017-17058 | woocommerce (WordPress plugin) | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/ema | high | 7.5 | 24% |
| CVE-2022-31101 | prestashop/blockwishlist | BlockWishList SQL Injection vulnerability | high | 8.1 | 23% |
| CVE-2020-5777 | dweeves/magmi | Authentication bypass in MAGMI | critical | 9.8 | 23% |
| CVE-2021-44567 | francoisjacquet/rosariosis | SQL injection in francoisjacquet/rosariosis | critical | 9.8 | 23% |
| CVE-2017-15367 | bacula-web/bacula-web | Bacula-web SQL Injection Vulnerabilities | critical | 9.8 | 23% |
| CVE-2020-7048 | wordpress-database-reset (WordPress plugin) | The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the databas | critical | 9.1 | 23% |
| CVE-2023-3124 | elementor-pro (WordPress plugin) | The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_ | high | 8.8 | 23% |
| CVE-2023-2877 | formidable-forms (WordPress plugin) | The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality fo | high | 8.8 | 22% |
| CVE-2019-7139 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition SQLi Vulnerability | critical | 9.8 | 22% |
| CVE-2015-3302 | thecartpress-ecommerce-shopping-cart (WordPress plugin) | The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote | high | 7.5 | 22% |
| CVE-2019-25224 | wp-database-backup (WordPress plugin) | The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vu | critical | 9.8 | 22% |
| CVE-2018-19246 | athlon1600/php-proxy | LFI in PHP-Proxy 5.1.0 | high | 7.5 | 22% |
| CVE-2021-39341 | optinmonster (WordPress plugin) | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient aut | high | 8.2 | 22% |
| CVE-2022-1390 | admin-word-count-column (WordPress plugin) | The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthe | critical | 9.8 | 22% |
| CVE-2025-2005 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads fie | critical | 9.8 | 22% |
| CVE-2023-3824 | PHP engine | Stack buffer overflow / RCE when loading a crafted PHAR archive | critical | 9.8 | 22% |
| CVE-2022-3921 | listingo (WordPress plugin) | The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, whic | critical | 9.8 | 21% |
| CVE-2022-38352 | topthink/framework | ThinkPHP deserialization vulnerability | critical | 9.8 | 21% |
| CVE-2021-26599 | impresscms/impresscms | SQL Injection in ImpressCMS | critical | 9.8 | 21% |
| CVE-2015-1579 | divi (WordPress theme) | Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (d | medium | 5.0 | 21% |
| CVE-2019-14348 | joomsport (WordPress plugin) | The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_seaso | critical | 9.8 | 21% |
| CVE-2014-9734 | patch-for-revolution-slider (WordPress plugin) | Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbit | medium | 5.0 | 20% |
| CVE-2024-55416 | tcg/voyager | DevDojo Voyager vulnerable to reflected Cross-site Scripting | low | 0.0 | 20% |
| CVE-2024-32480 | librenms/librenms | LibreNMS vulnerable to a Time-Based Blind SQL injection leads to database extraction | high | 7.2 | 20% |
| CVE-2022-0591 | formcraft3 (WordPress plugin) | The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues e | critical | 9.1 | 20% |
| CVE-2017-6920 | drupal/core, drupal/drupal | Drupal PECL YAML parser unsafe object handling | critical | 9.8 | 20% |
| CVE-2025-8085 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthe | high | 8.6 | 20% |
| CVE-2019-12616 | phpmyadmin/phpmyadmin | phpMyAdmin CSRF Vulnerability | medium | 6.5 | 20% |
| CVE-2022-1556 | stafflist (WordPress plugin) | The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when search | critical | 9.8 | 20% |
| CVE-2019-15858 | woody-ad-snippets (WordPress plugin) | admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, | high | 8.8 | 20% |
| CVE-2021-43617 | laravel/framework | Image upload bypass | unknown | 0.0 | 20% |
| CVE-2022-1119 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloade | high | 7.5 | 20% |
| CVE-2023-0156 | all-in-one-security (WordPress plugin) | The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an au | medium | 4.9 | 20% |
| CVE-2023-24775 | funadmin/funadmin | SQL Injection in Funadmin | critical | 9.8 | 20% |
| CVE-2024-6457 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author | critical | 9.8 | 20% |
| CVE-2023-0329 | website-builder (WordPress plugin) | The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools mo | high | 7.2 | 20% |
| CVE-2009-2762 | WordPress core | wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly t | high | 7.5 | 20% |
| CVE-2023-4372 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and includi | medium | 6.4 | 20% |
| CVE-2019-6715 | w3-total-cache (WordPress plugin) | pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL fie | high | 7.5 | 19% |
| CVE-2014-4940 | tera-charts (WordPress plugin) | Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary | medium | 5.0 | 19% |
| CVE-2019-19208 | codiad/codiad | Code injection in codiad | critical | 9.8 | 19% |