Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-7422 | site-editor (WordPress plugin) | A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary fil | high | 7.5 | 62% |
| CVE-2023-2249 | wpforo (WordPress plugin) | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions | high | 8.8 | 61% |
| CVE-2020-5295 | october/cms | Local File read vulnerability in OctoberCMS | medium | 4.8 | 7% |
| CVE-2023-6971 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP heade | high | 8.1 | 6% |
| CVE-2017-6381 | drupal/core, drupal/drupal | Drupal Remote code execution | high | 8.1 | 4% |
| CVE-2024-8252 | clean-login (WordPress plugin) | The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' a | high | 8.8 | 3% |
| CVE-2012-4919 | gallery (WordPress plugin) | Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability | critical | 9.8 | 3% |
| CVE-2019-15839 | sina-extension-for-elementor (WordPress plugin) | The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. | high | 7.5 | 2% |
| CVE-2021-38360 | wp-publications (WordPress plugin) | The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser | high | 8.3 | 2% |
| CVE-2021-3603 | phpmailer/phpmailer | PHPMailer untrusted code may be run from an overridden address validator | high | 8.1 | 2% |
| CVE-2019-8154 | magento/community-edition, magento/product-community-edition | Magento remote code execution vulnerability | high | 8.8 | 2% |
| CVE-2021-20187 | moodle/moodle | Moodle Arbitrary PHP code execution by site admins via Shibboleth configuration | high | 7.2 | 2% |
| CVE-2019-11590 | form-maker (WordPress plugin) | The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local f | high | 8.8 | 1% |
| CVE-2023-4488 | dropbox-folder-share (WordPress plugin) | The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php | critical | 9.8 | 1% |
| CVE-2019-11591 | contact-form-maker (WordPress plugin) | The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant l | high | 8.8 | 1% |
| CVE-2024-13353 | responsive-addons-for-elementor (WordPress plugin) | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Local File | high | 8.8 | 1% |
| CVE-2024-4359 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.5 | 1% |
| CVE-2024-24821 | composer/composer | Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php | high | 8.8 | 0% |