Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-9841 KEV | phpunit/phpunit | Code Injection in PHPUnit | critical | 9.8 | 100% |
| CVE-2021-3129 KEV | facade/ignition | Unauthenticated remote code execution via insecure file handling in debug mode | critical | 9.8 | 100% |
| CVE-2025-32432 KEV | craftcms/cms | Craft CMS Allows Remote Code Execution | critical | 10.0 | 100% |
| CVE-2018-7602 KEV | drupal/core, drupal/drupal | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows a | critical | 9.8 | 99% |
| CVE-2024-56145 KEV | craftcms/cms | Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled | critical | 9.8 | 97% |
| CVE-2025-54068 KEV | livewire/livewire | Livewire is vulnerable to remote command execution during component property update hydration | critical | 9.8 | 96% |
| CVE-2025-23209 KEV | craftcms/cms | Craft CMS has a potential RCE with a compromised security key | high | 8.0 | 22% |
| CVE-2023-6553 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includ | critical | 9.8 | 98% |
| CVE-2023-41892 | craftcms/cms | Craft CMS Remote Code Execution vulnerability | critical | 10.0 | 94% |
| CVE-2024-43425 | moodle/moodle | Moodle Remote Code Execution vulnerability | high | 8.1 | 88% |
| CVE-2021-26120 | smarty/smarty | PHP Code Injection by malicious function name in smarty | critical | 9.8 | 82% |
| CVE-2016-5734 | phpmyadmin/phpmyadmin | phpMyAdmin Code Injection vulnerability | critical | 9.8 | 81% |
| CVE-2020-36708 | activello (WordPress plugin), affluent (WordPress plugin), allegiant (WordPress plugin) +13 more | The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, | critical | 9.8 | 65% |
| CVE-2022-1609 | school-management (WordPress plugin) | The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a | critical | 9.8 | 64% |
| CVE-2008-5619 | phpmailer/phpmailer | PHPMailer susceptible to arbitrary code execution | high | 0.0 | 59% |
| CVE-2021-25003 | wpcargo-track-\&-trace (WordPress plugin) | The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anyw | critical | 9.8 | 56% |
| CVE-2025-49132 | pterodactyl/panel | Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution | critical | 10.0 | 54% |
| CVE-2024-9061 | wp-popup-builder (WordPress plugin) | The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via | high | 7.3 | 52% |
| CVE-2023-43661 | cachethq/cachet | Cachet vulnerable to Authenticated Remote Code Execution | critical | 9.1 | 52% |
| CVE-2020-13756 | sabberworm/php-css-parser | Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors() | critical | 9.8 | 50% |
| CVE-2014-6446 | infusionsoft (WordPress plugin) | The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to | high | 7.5 | 46% |
| CVE-2022-0819 | dolibarr/dolibarr | Code injection in dolibarr/dolibarr | high | 8.8 | 43% |
| CVE-2013-3630 | moodle/moodle | Moodle Authenticated Spelling Binary Remote Code Execution | medium | 0.0 | 42% |
| CVE-2022-0661 | ad-injection (WordPress plugin) | The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a hi | high | 7.2 | 40% |
| CVE-2015-8351 | gwolle-gb (WordPress plugin) | PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows | critical | 9.0 | 37% |
| CVE-2022-40871 | dolibarr/dolibarr | Dolibarr vulnerable to Eval Injection | critical | 9.8 | 35% |
| CVE-2020-15227 | nette/application, nette/nette | Potential Remote Code Execution vulnerability | high | 8.7 | 34% |
| CVE-2019-18889 | symfony/cache, symfony/symfony | Symfony Unsafe Cache Serialization Could Enable RCE | critical | 9.8 | 33% |
| CVE-2018-14716 | nystudio107/craft-seomatic | SEOmatic plugin for Craft CMS SSTI Vulnerability | high | 7.5 | 33% |
| CVE-2018-1133 | moodle/moodle | Moodle calculated question type allows remote code execution by Question authors | high | 8.8 | 31% |
| CVE-2024-55661 | laravel/pulse | Laravel Pulse Allows Remote Code Execution via Unprotected Query Method | high | 0.0 | 31% |
| CVE-2021-29440 | getgrav/grav | Grav's Twig processing allowing dangerous PHP functions by default | high | 8.4 | 30% |
| CVE-2023-38886 | dolibarr/dolibarr | Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script | high | 7.2 | 30% |
| CVE-2021-24209 | wp-super-cache (WordPress plugin) | The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation | high | 7.2 | 28% |
| CVE-2024-6386 | wpml (WordPress plugin) | The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Templ | critical | 9.9 | 26% |
| CVE-2017-6920 | drupal/core, drupal/drupal | Drupal PECL YAML parser unsafe object handling | critical | 9.8 | 20% |
| CVE-2019-19208 | codiad/codiad | Code injection in codiad | critical | 9.8 | 19% |
| CVE-2021-41749 | nystudio107/craft-seomatic | Code Injection in SEOmatic | critical | 9.8 | 17% |
| CVE-2023-6846 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_chec | high | 8.8 | 16% |
| CVE-2024-31819 | wwbn/avideo | WWBN AVideo Remote Code Execution | critical | 9.8 | 16% |
| CVE-2014-8877 | cm-download-manager (WordPress plugin) | The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for | high | 10.0 | 14% |
| CVE-2011-2505 | phpmyadmin/phpmyadmin | phpMyAdmin remote variable manipulation | medium | 0.0 | 13% |
| CVE-2024-9593 | time-clock (WordPress plugin) | The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2. | high | 8.3 | 12% |
| CVE-2022-2073 | getgrav/grav | Code injection in grav | high | 7.2 | 11% |
| CVE-2017-15806 | zetacomponents/mail | Zeta Components Mail Arbitrary code execution via a crafted email address | high | 8.1 | 11% |
| CVE-2011-2506 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to static code injection | high | 0.0 | 10% |
| CVE-2022-0885 | member-hero (WordPress plugin) | The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, | critical | 9.8 | 9% |
| CVE-2013-4338 | WordPress core | wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attack | high | 7.5 | 9% |
| CVE-2020-10257 | addons (WordPress plugin), aldo-gutenberg-wordpress-blog-theme (WordPress plugin), amuli (WordPress plugin) +60 more | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allow | critical | 9.8 | 9% |
| CVE-2013-3239 | phpmyadmin/phpmyadmin | phpMyAdmin Remote Code Execution | high | 8.5 | 9% |