Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-9735 | showbiz-pro (WordPress plugin), slider-revolution (WordPress plugin) | The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does | high | 7.5 | 76% |
| CVE-2015-2673 | wp-easycart (WordPress plugin) | The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 th | high | 8.8 | 19% |
| CVE-2014-5337 | wordpress-mobile-pack (WordPress plugin) | The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remo | medium | 5.0 | 17% |
| CVE-2015-2791 | wpml (WordPress plugin) | The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus v | medium | 6.4 | 13% |
| CVE-2015-1375 | pixabay-images (WordPress plugin) | pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, whic | high | 7.5 | 12% |
| CVE-2014-1889 | buddypress (WordPress plugin) | The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrar | medium | 6.5 | 11% |
| CVE-2010-0682 | WordPress core | WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p p | medium | 4.0 | 10% |
| CVE-2014-3848 | imember360 (WordPress plugin) | The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database crede | medium | 5.0 | 9% |
| CVE-2015-4038 | wpmembership (WordPress plugin) | The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_ | medium | 6.5 | 8% |
| CVE-2014-9262 | duplicator (WordPress plugin) | The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files. | high | 8.2 | 7% |
| CVE-2014-8802 | pie-register (WordPress plugin) | The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows | medium | 5.0 | 7% |
| CVE-2014-8605 | xcloner (WordPress plugin) | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with ins | medium | 5.0 | 7% |
| CVE-2015-5715 | WordPress core | The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authentic | medium | 4.3 | 6% |
| CVE-2014-3849 | imember360 (WordPress plugin) | The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbit | medium | 4.3 | 6% |
| CVE-2009-2853 | WordPress core | Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, | high | 10.0 | 5% |
| CVE-2008-0664 | WordPress core | The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of ot | medium | 6.4 | 4% |
| CVE-2012-2401 | WordPress core | Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the | medium | 5.0 | 3% |
| CVE-2022-41978 | zoho-crm-forms (WordPress plugin) | Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress. | high | 8.8 | 3% |
| CVE-2022-33198 | accordions-or-faqs (WordPress plugin) | Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress. | critical | 9.8 | 3% |
| CVE-2022-34487 | shortcode-addons (WordPress plugin) | Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress. | critical | 9.8 | 3% |
| CVE-2012-3383 | WordPress core | The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not p | low | 2.6 | 3% |
| CVE-2009-2432 | WordPress core | WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, whic | medium | 5.0 | 3% |
| CVE-2008-2146 | WordPress core | wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remot | high | 7.5 | 3% |
| CVE-2007-0541 | WordPress core | WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback s | medium | 5.0 | 3% |
| CVE-2013-4340 | WordPress core | wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the A | low | 3.5 | 3% |
| CVE-2012-2402 | WordPress core | wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and de | medium | 5.5 | 3% |
| CVE-2008-3747 | WordPress core | The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force S | high | 7.5 | 3% |
| CVE-2010-5293 | WordPress core | wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote | medium | 5.8 | 3% |
| CVE-2014-0165 | WordPress core | WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related | medium | 4.0 | 2% |
| CVE-2009-2854 | WordPress core | Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or addition | medium | 6.4 | 2% |
| CVE-2014-0173 | jetpack (WordPress plugin) | The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4 | medium | 5.8 | 2% |
| CVE-2010-5297 | WordPress core | WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once chang | low | 2.1 | 2% |
| CVE-2021-36879 | ulisting (WordPress plugin) | Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration all | critical | 9.8 | 2% |
| CVE-2010-5106 | WordPress core | The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote au | medium | 6.5 | 2% |
| CVE-2016-10935 | woocommerce-exporter (WordPress plugin) | The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation. | critical | 9.8 | 2% |
| CVE-2016-10922 | woocommerce-store-toolkit (WordPress plugin) | The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation. | critical | 9.8 | 2% |
| CVE-2013-3264 | wp-ultimate-email-marketer-plugin (WordPress plugin) | The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2 | medium | 6.4 | 2% |
| CVE-2016-10923 | woocommerce-store-toolkit (WordPress plugin) | The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation. | critical | 9.8 | 2% |
| CVE-2012-6634 | WordPress core | wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachm | medium | 6.4 | 2% |
| CVE-2013-2199 | WordPress core | The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to | medium | 4.3 | 2% |
| CVE-2013-2203 | WordPress core | WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an inva | medium | 4.3 | 2% |
| CVE-2011-3129 | WordPress core | The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," | high | 9.3 | 2% |
| CVE-2016-10886 | wp-editor (WordPress plugin) | The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions. | critical | 9.8 | 2% |
| CVE-2012-3385 | WordPress core | WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or con | medium | 5.0 | 2% |
| CVE-2012-4421 | WordPress core | The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows | medium | 4.0 | 2% |
| CVE-2015-5682 | powerplay-gallery (WordPress plugin) | upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to | high | 7.5 | 2% |
| CVE-2013-2200 | WordPress core | WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restric | medium | 4.0 | 2% |
| CVE-2012-6635 | WordPress core | wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remot | medium | 4.0 | 2% |
| CVE-2010-5296 | WordPress core | wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for th | medium | 4.9 | 2% |
| CVE-2012-4422 | WordPress core | wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges b | low | 3.5 | 2% |