Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-9039 | WordPress core | wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset p | medium | 4.3 | 2% |
| CVE-2016-10148 | WordPress core | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checkin | medium | 4.3 | 2% |
| CVE-2015-9331 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. | high | 7.5 | 1% |
| CVE-2015-9318 | awesome-support (WordPress plugin) | The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies. | high | 7.5 | 1% |