Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0984 | moodle/moodle | Missing authorization in Moodle | medium | 4.3 | 1% |
| CVE-2022-0985 | moodle/moodle | Improper Authentication in moodle | medium | 4.3 | 1% |
| CVE-2023-35093 | masterstudy-lms (WordPress plugin) | Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 ve | medium | 6.5 | 1% |
| CVE-2023-4198 | dolibarr/dolibarr | Dolibarr Improper Input Validation vulnerability | medium | 6.5 | 1% |
| CVE-2024-1047 | orbit-fox (WordPress plugin) | Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing cap | medium | 5.3 | 1% |
| CVE-2024-11354 | ultimate-youtube-video-player (WordPress plugin) | The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 1% |
| CVE-2020-36670 | nex-forms (WordPress plugin) | The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 | medium | 6.3 | 1% |
| CVE-2023-6965 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, | medium | 4.3 | 1% |
| CVE-2023-2261 | wp-security-audit-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call fun | medium | 4.3 | 1% |
| CVE-2025-54265 | magento/community-edition, magento/project-community-edition | Magento allows incorrect authorization | medium | 5.9 | 1% |
| CVE-2024-43118 | hummingbird (WordPress plugin) | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects | medium | 4.3 | 1% |
| CVE-2022-4943 | miniorange-2-factor-authentication (WordPress plugin) | The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when chan | high | 7.5 | 1% |
| CVE-2024-9578 | hide-links (WordPress plugin) | The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_t | medium | 5.3 | 1% |
| CVE-2023-0993 | wp-simple-firewall (WordPress plugin) | The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, an | medium | 4.3 | 1% |
| CVE-2022-0229 | google-authenticator (WordPress plugin) | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the recon | high | 8.1 | 1% |
| CVE-2021-42367 | variation-swatches-for-woocommerce (WordPress plugin) | The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/i | medium | 6.4 | 1% |
| CVE-2024-1079 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() | medium | 5.3 | 1% |
| CVE-2024-1109 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ini | medium | 5.3 | 1% |
| CVE-2020-36835 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's databa | medium | 4.9 | 1% |
| CVE-2022-41692 | appointment-hour-booking (WordPress plugin) | Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. | medium | 4.3 | 1% |
| CVE-2022-43482 | appointment-booking-calendar (WordPress plugin) | Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. | medium | 4.3 | 1% |
| CVE-2023-1333 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | medium | 4.3 | 1% |
| CVE-2023-1334 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability che | medium | 4.3 | 1% |
| CVE-2023-1335 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability | medium | 4.3 | 1% |
| CVE-2023-1336 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check | medium | 4.3 | 1% |
| CVE-2023-1338 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability che | medium | 4.3 | 1% |
| CVE-2023-1339 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check | medium | 4.3 | 1% |
| CVE-2023-2078 | buymeacoffee (WordPress plugin) | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capa | high | 7.3 | 1% |
| CVE-2024-1352 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification | medium | 6.5 | 1% |
| CVE-2024-5570 | simple-photoswipe (WordPress plugin) | The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authe | medium | 6.5 | 1% |
| CVE-2024-37444 | defender (WordPress plugin) | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects | medium | 5.3 | 1% |
| CVE-2025-24421 | magento/community-edition, magento/project-community-edition | Magento Incorrect Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2025-24436 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2023-6785 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, a | medium | 5.3 | 1% |
| CVE-2024-24822 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle permissions are not getting checked when working with tags | medium | 6.5 | 1% |
| CVE-2024-12812 | wp-erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected | high | 7.5 | 1% |
| CVE-2023-6637 | host-analyticsjs-local (WordPress plugin) | The CAOS | Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 6.5 | 1% |
| CVE-2024-10529 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 5.3 | 1% |
| CVE-2023-6638 | gg-woo-feed (WordPress plugin) | The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 6.5 | 1% |
| CVE-2024-10531 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 5.3 | 1% |
| CVE-2023-4242 | full-customer (WordPress plugin) | The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including | medium | 4.3 | 1% |
| CVE-2023-4245 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetI | medium | 4.3 | 1% |
| CVE-2023-3574 | pimcore/customer-management-framework-bundle | Pimcore Customer Management Framework vulnerable to Improper Authorization in Rules Controller | medium | 6.5 | 1% |
| CVE-2023-1023 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitem | medium | 5.4 | 1% |
| CVE-2023-1024 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSit | medium | 4.3 | 1% |
| CVE-2022-1572 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated use | high | 8.1 | 1% |
| CVE-2021-25095 | country-blocker (WordPress plugin) | The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocke | high | 7.1 | 1% |
| CVE-2021-24914 | tawk.to-live-chat (WordPress plugin) | The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget | high | 8.0 | 1% |
| CVE-2025-6993 | ultimate-wp-mail (WordPress plugin) | The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_detai | high | 7.5 | 1% |
| CVE-2024-45125 | magento/community-edition | Magento Open Source Incorrect Authorization vulnerability | medium | 4.3 | 1% |