Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-35296 | zoujingli/thinkadmin | ThinkAdmin Admin Panel Access using Default Credentials | high | 7.5 | 2% |
| CVE-2019-15867 | slick-popup (WordPress plugin) | The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber ca | high | 8.8 | 2% |
| CVE-2016-10928 | onelogin-saml-sso (WordPress plugin) | The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users. | high | 7.5 | 2% |
| CVE-2026-55579 | pheditor/pheditor | Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise | critical | 9.8 | 1% |
| CVE-2023-1269 | alextselegidis/easyappointments | Easy!Appointments uses hard-coded credentials | critical | 9.8 | 1% |
| CVE-2023-5318 | microweber/microweber | Microweber uses hard coded credentials | medium | 5.8 | 1% |
| CVE-2024-13688 | admin-and-site-enhancements (WordPress plugin) | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing | medium | 5.3 | 0% |
| CVE-2024-13773 | civi (WordPress plugin) | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver | high | 7.3 | 0% |