Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2009-2762 | WordPress core | wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly t | high | 7.5 | 20% |
| CVE-2016-5838 | WordPress core | WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie. | high | 7.5 | 3% |
| CVE-2014-9039 | WordPress core | wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset p | medium | 4.3 | 2% |
| CVE-2016-10148 | WordPress core | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checkin | medium | 4.3 | 2% |
| CVE-2015-9331 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. | high | 7.5 | 1% |
| CVE-2015-9318 | awesome-support (WordPress plugin) | The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies. | high | 7.5 | 1% |
| CVE-2023-6947 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includin | high | 7.7 | 1% |
| CVE-2023-2881 | pimcore/customer-management-framework-bundle | Pimcore customers' list user password hash is disclosed | medium | 6.7 | 1% |
| CVE-2014-8335 | wp-dbmanager (WordPress plugin) | (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credenti | high | 7.8 | 1% |
| CVE-2023-5775 | backwpup (WordPress plugin) | The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4. | low | 2.2 | 0% |
| CVE-2025-67510 | neuron-core/neuron-ai | Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”) | critical | 9.4 | 0% |
| CVE-2024-3073 | easy-wp-smtp (WordPress plugin) | The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versio | low | 2.7 | 0% |
| CVE-2020-8934 | site-kit (WordPress plugin) | The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This i | medium | 4.3 | 0% |
| GHSA-wj85-rg5g-v8jm | typo3/cms-core | TYPO3 Information Disclosure in User Authentication | medium | 5.3 | – |