Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-19207 | wp-gdpr-compliance (WordPress plugin) | The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code | critical | 9.8 | 88% |
| CVE-2022-2551 | duplicator (WordPress plugin) | The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endp | high | 7.5 | 18% |
| CVE-2021-24215 | controlled-admin-access (WordPress plugin) | An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to | critical | 9.8 | 9% |
| CVE-2022-2544 | ninja-job-board (WordPress plugin) | The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to u | high | 7.5 | 5% |
| CVE-2005-1688 | WordPress core | Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, ( | medium | 5.3 | 2% |
| CVE-2021-24695 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or auth | high | 7.5 | 2% |
| CVE-2022-4057 | autooptimize (WordPress plugin) | The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs. | medium | 5.3 | 1% |
| CVE-2025-47226 | snipe/snipe-it | Grokability Snipe-IT has incorrect authorization for accessing asset information | medium | 5.0 | 1% |
| CVE-2018-19620 | showdoc/showdoc | Showdoc Unauthenticated Access | medium | 4.3 | 1% |
| CVE-2021-24831 | tab (WordPress plugin) | All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenti | high | 7.5 | 1% |
| CVE-2021-24238 | findeo (WordPress plugin), realteo (WordPress plugin) | The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the | medium | 6.5 | 1% |
| CVE-2022-1551 | sp-project-\&-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that | medium | 6.5 | 1% |
| CVE-2025-48201 | nitsan/ns-backup | The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location | high | 8.6 | 0% |
| CVE-2025-48205 | sjbr/sr-feuser-register | The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference | high | 8.6 | 0% |
| CVE-2025-48207 | renolit/reint-downloadmanager | reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference | medium | 5.3 | 0% |
| CVE-2025-48202 | in2code/femanager | The femanager TYPO3 extension allows Insecure Direct Object Reference | medium | 5.3 | 0% |
| CVE-2026-8205 | concrete5/concrete5 | Concrete CMS is vulnerable to authorization bypass in the Calendar Block | medium | 5.3 | 0% |
| GHSA-x5w2-wcr8-9q45 | silverstripe/framework | Silverstripe Missing security check on dev/build/defaults | medium | 6.5 | – |
| GHSA-w8fq-xgvh-cxc2 | silverstripe/forum | Silverstripe Forum Module CSRF Vulnerability | medium | 5.3 | – |