Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-5487 | WordPress core | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not prop | medium | 5.3 | 87% |
| CVE-2018-7251 | anchorcms/anchor-cms | Anchor CMS Logs Credentials | critical | 9.8 | 72% |
| CVE-2021-39327 | bulletproof-security (WordPress plugin) | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly ac | medium | 5.3 | 72% |
| CVE-2009-0815 | typo3/cms | TYPO3 leaks a hash secret in an error message | medium | 0.0 | 42% |
| CVE-2014-2383 | dompdf/dompdf | DOMPDF Arbitrary File Read | medium | 0.0 | 39% |
| CVE-2019-17671 | WordPress core | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. | medium | 5.3 | 37% |
| CVE-2021-38314 | gutenberg-template-library-\&-redux-framework (WordPress plugin) | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated | medium | 5.3 | 29% |
| CVE-2023-2916 | iwp-client (WordPress plugin) | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the | high | 7.5 | 24% |
| CVE-2018-19246 | athlon1600/php-proxy | LFI in PHP-Proxy 5.1.0 | high | 7.5 | 22% |
| CVE-2021-4428 | autosuggest (WordPress plugin) | A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vul | low | 2.7 | 16% |
| CVE-2013-0291 | nextgen-gallery (WordPress plugin) | NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability | high | 7.5 | 16% |
| CVE-2023-33568 | dolibarr/dolibarr | Dolibarr vulnerable to unauthenticated database access | high | 7.5 | 15% |
| CVE-2020-13405 | microweber/microweber | Microweber Discloses Sensitive Information | high | 7.5 | 14% |
| CVE-2020-13700 | acf-to-rest-api (WordPress plugin), airesvsg/acf-to-rest-api | An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permali | high | 7.5 | 13% |
| CVE-2015-2826 | simple-ads-manager (WordPress plugin) | WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. | medium | 5.3 | 13% |
| CVE-2011-4107 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to XML external entity (XXE) injection attack | medium | 6.5 | 13% |
| CVE-2022-0281 | microweber/microweber | Exposure of Sensitive Information to an Unauthorized Actor in microweber | high | 7.5 | 10% |
| CVE-2015-6830 | phpmyadmin/phpmyadmin | phpMyAdmin ReCaptcha bypass | medium | 0.0 | 10% |
| CVE-2018-20555 | social-network-tabs (WordPress plugin) | The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_se | critical | 9.8 | 10% |
| CVE-2015-6668 | job-manager (WordPress plugin) | The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload dir | high | 7.5 | 10% |
| CVE-2015-1000012 | mypixs (WordPress plugin) | Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin | high | 7.5 | 9% |
| CVE-2011-4898 | WordPress core | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacki | medium | 5.0 | 9% |
| CVE-2020-9043 | wp-central (WordPress plugin) | The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key. | high | 8.8 | 7% |
| CVE-2015-5730 | WordPress core | The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time c | medium | 5.0 | 7% |
| CVE-2014-8604 | xcloner (WordPress plugin) | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration pane | medium | 5.0 | 7% |
| CVE-2014-1908 | videowhisper-live-streaming-integration (WordPress plugin) | The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integra | medium | 5.0 | 7% |
| CVE-2021-24227 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by | high | 7.5 | 6% |
| CVE-2021-37704 | phpfastcache/phpfastcache | Exposed phpinfo() leadked via documentation files | medium | 5.4 | 6% |
| CVE-2018-20151 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual config | high | 7.5 | 6% |
| CVE-2021-25118 | yoast-seo (WordPress plugin) | The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/po | medium | 5.3 | 6% |
| CVE-2021-24170 | user-profile-picture (WordPress plugin) | The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for it | high | 7.5 | 6% |
| CVE-2026-61450 | getgrav/grav | Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) | medium | 6.5 | 5% |
| CVE-2021-24226 | accessally (WordPress plugin) | In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_ | high | 7.5 | 5% |
| CVE-2024-1208 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. | medium | 5.3 | 5% |
| CVE-2017-5610 | WordPress core | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assign | medium | 5.3 | 5% |
| CVE-2018-19487 | wp-jobhunt (WordPress plugin) | The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function throug | high | 7.5 | 5% |
| CVE-2014-4942 | wp-easycart (WordPress plugin) | The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct reques | medium | 5.0 | 5% |
| CVE-2016-5835 | WordPress core | WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, re | high | 7.5 | 4% |
| CVE-2022-2462 | transposh-translation-filter-for-wordpress (WordPress plugin) | The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versi | medium | 5.3 | 4% |
| CVE-2020-15086 | friendsoftypo3/mediace | Potential Remote Code Execution in TYPO3 with mediace extension | critical | 9.8 | 4% |
| CVE-2015-3634 | slideshow-jquery-image-gallery (WordPress plugin) | The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remo | high | 7.5 | 3% |
| CVE-2020-9591 | magento/community-edition, magento/core | Magento defense-in-depth security mitigation vulnerability | high | 7.5 | 3% |
| CVE-2008-0195 | WordPress core | WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP | medium | 5.0 | 3% |
| CVE-2012-6512 | organizer (WordPress plugin) | The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to (1) plugin_hook. | medium | 5.0 | 3% |
| CVE-2018-6015 | email-subscribers (WordPress plugin) | An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI wi | high | 7.5 | 3% |
| CVE-2015-9269 | wordpress-mobile-pack (WordPress plugin) | The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attacke | high | 7.5 | 3% |
| CVE-2011-0701 | WordPress core | wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) p | medium | 4.0 | 3% |
| CVE-2012-1607 | typo3/cms | TYPO3 allows remote attackers to obtain the database name via a direct request | medium | 0.0 | 3% |
| CVE-2015-9481 | diplomat-\|-political (WordPress theme) | The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as | high | 7.5 | 3% |
| CVE-2015-9482 | car-dealer-\/-auto-dealer-responsive (WordPress theme) | The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive infor | high | 7.5 | 3% |