Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0718 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder func | medium | 5.4 | 1% |
| CVE-2023-6821 | error-log-viewer (WordPress plugin) | The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and downl | medium | 6.5 | 1% |
| CVE-2022-0178 | snipe/snipe-it | Improper Access Control in snipe-it | medium | 5.4 | 1% |
| CVE-2024-13556 | affiliate-links (WordPress plugin) | The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in al | high | 8.1 | 1% |
| CVE-2023-0447 | youtube-channel (WordPress plugin) | The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache f | medium | 4.3 | 1% |
| CVE-2024-12269 | safe-ai-malware-protection-for-wp (WordPress plugin) | The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on | high | 7.5 | 1% |
| CVE-2021-24890 | scripts-organizer (WordPress plugin) | The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both | high | 8.8 | 1% |
| CVE-2025-27188 | magento/community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2024-1169 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | high | 7.5 | 1% |
| CVE-2024-0447 | artibot (WordPress plugin) | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 5.0 | 1% |
| CVE-2023-22489 | flarum/core | Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted | low | 3.5 | 1% |
| CVE-2026-52766 | yeswiki/yeswiki | YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action | critical | 9.1 | 1% |
| CVE-2023-5905 | export-posts-with-images (WordPress plugin) | The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export | high | 8.1 | 1% |
| CVE-2024-1587 | newsmatic (WordPress theme) | The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsm | medium | 5.3 | 1% |
| CVE-2024-3601 | poll-maker (WordPress plugin) | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch | medium | 5.3 | 1% |
| CVE-2024-10528 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 4.3 | 1% |
| CVE-2024-12822 | media-manager (WordPress plugin) | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation | critical | 9.8 | 1% |
| CVE-2024-10393 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a mi | medium | 5.3 | 1% |
| CVE-2024-0385 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 1% |
| CVE-2024-10813 | woo-product-table (WordPress plugin) | The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposur | medium | 5.3 | 1% |
| CVE-2023-0684 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders | medium | 5.4 | 1% |
| CVE-2023-0711 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state funct | medium | 5.4 | 1% |
| CVE-2023-0713 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder funct | medium | 5.4 | 1% |
| CVE-2023-0715 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder fun | medium | 5.4 | 1% |
| CVE-2023-0716 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder func | medium | 5.4 | 1% |
| CVE-2023-0717 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder fu | medium | 5.4 | 1% |
| CVE-2023-0720 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_orde | medium | 5.4 | 1% |
| CVE-2023-1026 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory | medium | 4.3 | 1% |
| CVE-2026-82394 | sulu/sulu | Sulu: Fix authorization bypass when creating preview links | medium | 0.0 | 1% |
| CVE-2021-24779 | wp-debugging (WordPress plugin) | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and | medium | 6.5 | 1% |
| CVE-2024-1452 | generateblocks (WordPress plugin) | The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2 via Quer | medium | 4.3 | 1% |
| CVE-2023-3403 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_ | medium | 5.4 | 1% |
| CVE-2023-1169 | ooohboi-steroids-for-elementor (WordPress plugin) | The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'fil | medium | 4.3 | 1% |
| CVE-2022-4932 | boldgrid-backup (WordPress plugin) | The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missi | medium | 4.3 | 1% |
| CVE-2023-2086 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templa | medium | 4.3 | 1% |
| CVE-2025-54378 | elmsln/haxcms | HAX CMS API Lacks Authorization Checks | high | 8.3 | 1% |
| CVE-2024-2538 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 5.4 | 1% |
| CVE-2023-2083 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save f | medium | 4.3 | 1% |
| CVE-2023-4941 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability | medium | 4.3 | 1% |
| CVE-2023-4943 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability | medium | 4.3 | 1% |
| CVE-2024-3678 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 5.3 | 1% |
| CVE-2023-22251 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-6557 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 v | medium | 5.3 | 1% |
| CVE-2024-1121 | advanced-forms (WordPress plugin) | The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export | medium | 5.3 | 1% |
| CVE-2023-6158 | eventon (WordPress plugin), eventon-lite (WordPress plugin) | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of da | medium | 6.5 | 1% |
| CVE-2023-2715 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_tick | medium | 4.3 | 1% |
| CVE-2023-5426 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | high | 7.5 | 1% |
| CVE-2023-1022 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInforma | medium | 5.4 | 1% |
| CVE-2023-4469 | profile-extra-fields (WordPress plugin) | The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check | medium | 5.3 | 1% |
| CVE-2021-4074 | whmcs-bridge (WordPress plugin) | The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-br | medium | 6.4 | 1% |