Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5939 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing cap | medium | 5.3 | 0% |
| CVE-2023-6600 | host-webfonts-local (WordPress plugin) | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stor | high | 8.6 | 0% |
| CVE-2024-7032 | clover-online-orders (WordPress plugin) | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ' | medium | 6.5 | 0% |
| CVE-2024-13719 | pepro-ultimate-invoice (WordPress plugin) | The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2 | medium | 5.3 | 0% |
| CVE-2024-10900 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 6.5 | 0% |
| CVE-2024-9189 | eu-vat-for-woocommerce (WordPress plugin) | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch | medium | 5.3 | 0% |
| CVE-2024-2107 | blossom-spa (WordPress theme) | The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generate | medium | 5.8 | 0% |
| CVE-2026-48008 | shopware/core, shopware/platform | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass | medium | 6.5 | 0% |
| CVE-2023-6696 | popup-builder (WordPress plugin) | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of | high | 8.1 | 0% |
| CVE-2024-1095 | control-block-patterns (WordPress plugin) | The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a mi | medium | 5.3 | 0% |
| CVE-2024-1122 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of da | medium | 5.3 | 0% |
| CVE-2024-11712 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access | medium | 5.3 | 0% |
| CVE-2024-13800 | convertplus (WordPress plugin) | The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missin | high | 8.1 | 0% |
| CVE-2024-43431 | moodle/moodle | Moodle's IDOR in badges allows deletion of arbitrary badges | high | 7.5 | 0% |
| CVE-2021-24993 | ultimate-product-catalog (WordPress plugin) | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could al | medium | 6.5 | 0% |
| CVE-2023-5251 | grid-plus (WordPress plugin) | The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on | medium | 5.4 | 0% |
| CVE-2023-5713 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_va | medium | 4.3 | 0% |
| CVE-2023-5710 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants | medium | 4.3 | 0% |
| CVE-2024-1904 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts | medium | 4.3 | 0% |
| CVE-2022-3911 | iubenda-cookie-law-solution (WordPress plugin) | The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options | high | 8.8 | 0% |
| CVE-2023-2716 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2023-5314 | wp-extra (WordPress plugin) | The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2022-4972 | download-monitor (WordPress plugin) | The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes | high | 7.5 | 0% |
| CVE-2024-5940 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 6.5 | 0% |
| CVE-2024-13364 | adthrive-ads (WordPress plugin) | The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() an | medium | 5.3 | 0% |
| CVE-2024-11715 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access | medium | 4.8 | 0% |
| CVE-2023-2275 | wcfm-marketplace-rest-api (WordPress plugin) | The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data du | medium | 4.3 | 0% |
| CVE-2024-10591 | makewebbetter-hubspot-for-woocommerce (WordPress plugin) | The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable | high | 8.8 | 0% |
| CVE-2024-1136 | responsive-coming-soon (WordPress plugin) | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented U | medium | 5.3 | 0% |
| CVE-2026-28696 | craftcms/cms | Craft CMS has IDOR via GraphQL @parseRefs | high | 0.0 | 0% |
| CVE-2026-52822 | kimai/kimai | Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation | medium | 0.0 | 0% |
| CVE-2026-52828 | kimai/kimai | Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access | medium | 0.0 | 0% |
| CVE-2024-3553 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missin | medium | 6.5 | 0% |
| CVE-2021-4447 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to | high | 8.8 | 0% |
| CVE-2025-2110 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss | high | 8.8 | 0% |
| CVE-2024-13656 | click-mag (WordPress theme) | The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lea | high | 8.1 | 0% |
| CVE-2025-3876 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP vali | high | 8.8 | 0% |
| CVE-2024-12071 | evergreen-content-poster (WordPress plugin) | The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized l | medium | 5.3 | 0% |
| CVE-2024-10533 | wp-whatsapp (WordPress plugin) | The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install | medium | 4.3 | 0% |
| CVE-2026-56341 | wwbn/avideo | AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records | high | 7.5 | 0% |
| CVE-2023-2562 | gallery-metabox (WordPress plugin) | The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox func | medium | 4.3 | 0% |
| CVE-2024-5541 | ibtana-visual-editor (WordPress plugin) | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.3 | 0% |
| CVE-2024-0766 | envo-elementor-for-woocommerce (WordPress plugin) | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi | medium | 4.3 | 0% |
| CVE-2023-6496 | manage-notification-emails (WordPress plugin) | The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via | medium | 5.3 | 0% |
| CVE-2026-46337 | wwbn/avideo | AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` | medium | 5.3 | 0% |
| CVE-2024-1645 | mollie-forms (WordPress plugin) | The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrati | medium | 4.3 | 0% |
| CVE-2023-2757 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' | high | 7.4 | 0% |
| CVE-2023-6369 | export-wp-page-to-static-html (WordPress plugin) | The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a mi | medium | 5.4 | 0% |
| CVE-2023-5525 | limit-login-attempts-reloaded (WordPress plugin) | The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing | medium | 4.3 | 0% |
| CVE-2023-5737 | backup-and-migration (WordPress plugin) | The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as S | medium | 4.3 | 0% |