Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-9034 | WordPress core | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers | medium | 5.0 | 83% |
| CVE-2022-0968 | microweber/microweber | Integer Overflow in microweber | high | 7.2 | 4% |
| CVE-2019-9573 | hrm (WordPress plugin) | The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications. | high | 7.5 | 2% |
| CVE-2016-4828 | welcart-e-commerce (WordPress plugin) | The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by lever | medium | 6.5 | 2% |
| CVE-2021-24894 | reviews-plus (WordPress plugin) | The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denia | medium | 6.5 | 1% |
| CVE-2022-0913 | microweber/microweber | Integer Overflow or Wraparound in Microweber | high | 7.5 | 1% |
| CVE-2019-14794 | meta-box (WordPress plugin) | The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. | high | 7.5 | 1% |
| CVE-2022-1036 | microweber/microweber | Integer Overflow or Wraparound in Microweber | high | 7.5 | 1% |
| CVE-2021-25121 | rating (WordPress plugin) | The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a | medium | 6.5 | 1% |
| CVE-2022-0961 | microweber/microweber | Denial of service in microweber | high | 7.1 | 1% |