Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-7600 KEV | drupal/core, drupal/drupal | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows a | critical | 9.8 | 100% |
| CVE-2022-24086 KEV | magento/community-edition | Magento improper input validation vulnerability | critical | 9.8 | 99% |
| CVE-2025-54236 KEV | magento/community-edition, magento/project-community-edition | Magento Community Edition Improper Input Validation vulnerability | critical | 9.1 | 95% |
| CVE-2017-5487 | WordPress core | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not prop | medium | 5.3 | 87% |
| CVE-2018-7251 | anchorcms/anchor-cms | Anchor CMS Logs Credentials | critical | 9.8 | 72% |
| CVE-2021-39327 | bulletproof-security (WordPress plugin) | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly ac | medium | 5.3 | 72% |
| CVE-2014-5460 | slideshow-gallery (WordPress plugin) | Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated user | medium | 6.5 | 71% |
| CVE-2024-50340 | symfony/runtime, symfony/symfony | Symfony allows changing the environment through a query | high | 7.3 | 62% |
| CVE-2016-1209 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized | critical | 9.8 | 62% |
| CVE-2010-4335 | cakephp/cakephp | CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code | high | 0.0 | 55% |
| CVE-2022-35650 | moodle/moodle | Moodle Arbitrary file read when importing lesson questions | high | 7.5 | 54% |
| CVE-2020-13756 | sabberworm/php-css-parser | Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors() | critical | 9.8 | 50% |
| CVE-2014-9013 | wpmarketplace (WordPress plugin) | The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to c | high | 8.8 | 46% |
| CVE-2009-0815 | typo3/cms | TYPO3 leaks a hash secret in an error message | medium | 0.0 | 42% |
| CVE-2014-2383 | dompdf/dompdf | DOMPDF Arbitrary File Read | medium | 0.0 | 39% |
| CVE-2018-14009 | codiad/codiad | Codiad remote code execution vulnerability | critical | 9.8 | 38% |
| CVE-2019-17671 | WordPress core | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. | medium | 5.3 | 37% |
| CVE-2019-6339 | drupal/core, drupal/drupal | A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an | critical | 9.8 | 36% |
| CVE-2023-4197 | dolibarr/dolibarr | Dolibarr Improper Input Validation vulnerability | high | 7.5 | 36% |
| CVE-2021-38314 | gutenberg-template-library-\&-redux-framework (WordPress plugin) | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated | medium | 5.3 | 29% |
| CVE-2016-3109 | shopware/shopware | Shopware RCE Vulnerability | critical | 9.8 | 28% |
| CVE-2007-1277 | WordPress core | WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backd | high | 7.5 | 28% |
| CVE-2019-16405 | centreon/centreon | Improper Input Validation in Centreon Web | high | 7.2 | 27% |
| CVE-2023-2916 | iwp-client (WordPress plugin) | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the | high | 7.5 | 24% |
| CVE-2018-19246 | athlon1600/php-proxy | LFI in PHP-Proxy 5.1.0 | high | 7.5 | 22% |
| CVE-2021-4428 | autosuggest (WordPress plugin) | A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vul | low | 2.7 | 16% |
| CVE-2013-0291 | nextgen-gallery (WordPress plugin) | NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability | high | 7.5 | 16% |
| CVE-2023-33568 | dolibarr/dolibarr | Dolibarr vulnerable to unauthenticated database access | high | 7.5 | 15% |
| CVE-2013-7102 | optimizepress (WordPress theme) | Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php | medium | 6.8 | 15% |
| CVE-2020-13405 | microweber/microweber | Microweber Discloses Sensitive Information | high | 7.5 | 14% |
| CVE-2020-13700 | acf-to-rest-api (WordPress plugin), airesvsg/acf-to-rest-api | An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permali | high | 7.5 | 13% |
| CVE-2015-2826 | simple-ads-manager (WordPress plugin) | WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. | medium | 5.3 | 13% |
| CVE-2011-4107 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to XML external entity (XXE) injection attack | medium | 6.5 | 13% |
| CVE-2017-18580 | shortcodes-ultimate (WordPress plugin) | The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode. | critical | 9.8 | 12% |
| CVE-2008-5695 | WordPress core | wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, | high | 8.5 | 12% |
| CVE-2016-10956 | mail-masta (WordPress plugin) | The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php. | high | 7.5 | 11% |
| CVE-2022-0281 | microweber/microweber | Exposure of Sensitive Information to an Unauthorized Actor in microweber | high | 7.5 | 10% |
| CVE-2015-6830 | phpmyadmin/phpmyadmin | phpMyAdmin ReCaptcha bypass | medium | 0.0 | 10% |
| CVE-2018-20555 | social-network-tabs (WordPress plugin) | The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_se | critical | 9.8 | 10% |
| CVE-2015-6668 | job-manager (WordPress plugin) | The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload dir | high | 7.5 | 10% |
| CVE-2015-1000012 | mypixs (WordPress plugin) | Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin | high | 7.5 | 9% |
| CVE-2024-45440 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal Full Path Disclosure | medium | 5.3 | 9% |
| CVE-2011-4898 | WordPress core | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacki | medium | 5.0 | 9% |
| CVE-2016-10960 | wsecure (WordPress plugin) | The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter. | high | 8.8 | 9% |
| CVE-2022-35649 | moodle/moodle | Moodle PostScript Code Injection | critical | 9.8 | 9% |
| CVE-2018-1000773 | WordPress core | WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code | high | 8.8 | 8% |
| CVE-2013-4339 | WordPress core | WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redi | high | 7.5 | 8% |
| CVE-2018-20985 | wp-payeezy-pay (WordPress plugin) | The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec. | critical | 9.8 | 8% |
| CVE-2015-6497 | magento/core | Magento arbitrary PHP code execution via the productData parameter | high | 8.8 | 7% |
| CVE-2020-9043 | wp-central (WordPress plugin) | The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key. | high | 8.8 | 7% |