Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1307 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as l | medium | 6.5 | 1% |
| CVE-2023-1375 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized cache deletion in versions up to, and including, 1.1.2 due to a miss | medium | 4.3 | 1% |
| CVE-2023-4938 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability | medium | 4.3 | 1% |
| CVE-2024-1120 | finale (WordPress plugin), nextmove (WordPress plugin) | The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress | medium | 5.3 | 1% |
| CVE-2024-0791 | bulk-editor (WordPress plugin) | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or l | medium | 4.3 | 1% |
| CVE-2024-0829 | wp-comment-fields (WordPress plugin) | The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and incl | medium | 4.3 | 1% |
| CVE-2024-0835 | royal-elementor-kit (WordPress theme) | The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on th | medium | 4.3 | 1% |
| CVE-2024-1390 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to u | medium | 4.3 | 1% |
| CVE-2024-1843 | wp-auto-affiliate-links (WordPress plugin) | The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aa | medium | 4.3 | 1% |
| CVE-2024-2043 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due | medium | 5.3 | 1% |
| CVE-2024-8195 | permalink-manager (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug | medium | 5.3 | 1% |
| CVE-2023-6963 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it po | medium | 5.3 | 1% |
| CVE-2024-3610 | wp-child-theme-generator (WordPress plugin) | The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th | medium | 5.3 | 1% |
| CVE-2022-23180 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow | medium | 4.3 | 1% |
| CVE-2022-4948 | flyingpress (WordPress plugin) | The FlyingPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions | medium | 4.3 | 1% |
| CVE-2024-1127 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca | medium | 4.3 | 1% |
| CVE-2022-35921 | fof/byobu | Byobu user preference to prevent private discussions being started are not respected | low | 3.5 | 1% |
| CVE-2022-2450 | resmush.it-image-optimizer (WordPress plugin) | The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, | medium | 4.3 | 1% |
| CVE-2024-11725 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to pri | high | 8.8 | 1% |
| CVE-2023-2714 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_licen | medium | 4.3 | 1% |
| CVE-2021-24978 | osmapper (WordPress plugin) | The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with | medium | 5.3 | 1% |
| CVE-2024-43438 | moodle/moodle | Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users | high | 7.5 | 1% |
| CVE-2024-1566 | redirects (WordPress plugin) | The Redirects plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function | medium | 6.5 | 1% |
| CVE-2024-13371 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitr | medium | 5.3 | 1% |
| CVE-2024-3599 | gdpr-cookie-consent (WordPress plugin) | The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabil | medium | 5.3 | 1% |
| CVE-2021-24950 | insight-core (WordPress plugin) | The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (avai | medium | 5.4 | 1% |
| CVE-2021-25018 | ppom-for-woocommerce (WordPress plugin) | The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX act | medium | 5.4 | 1% |
| CVE-2021-25042 | visitor-statistics (WordPress plugin) | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress | medium | 5.4 | 1% |
| CVE-2022-2597 | visual-portfolio\,-photo-gallery-\&-post-grid (WordPress plugin) | The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST | medium | 5.4 | 1% |
| CVE-2023-4269 | user-activity-log (WordPress plugin) | The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated | medium | 4.3 | 1% |
| CVE-2024-13677 | get-bookings-wp (WordPress plugin) | The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via accoun | high | 8.8 | 1% |
| CVE-2022-3082 | discord-integration (WordPress plugin) | The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing | medium | 6.5 | 1% |
| CVE-2023-5509 | mystickymenu (WordPress plugin) | The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the act | medium | 5.4 | 1% |
| CVE-2023-5799 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and abov | medium | 5.4 | 1% |
| CVE-2024-1110 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 5.3 | 1% |
| CVE-2023-4686 | wp-customer-reviews (WordPress plugin) | The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the | medium | 4.3 | 1% |
| CVE-2024-12296 | superio (WordPress plugin) | The Apus Framework plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a mi | high | 8.8 | 1% |
| CVE-2024-13653 | zoxpress (WordPress theme) | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to p | high | 8.8 | 1% |
| CVE-2024-12006 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several func | medium | 5.3 | 1% |
| CVE-2024-1322 | directorist (WordPress plugin) | The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modifi | medium | 5.3 | 1% |
| CVE-2024-1389 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to u | medium | 5.3 | 1% |
| CVE-2024-6636 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | critical | 9.8 | 1% |
| CVE-2022-2987 | ldap-wp-login-\/-active-directory-integration (WordPress plugin) | The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating | high | 7.5 | 1% |
| CVE-2024-4223 | tutor-lms (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capabil | critical | 9.8 | 1% |
| CVE-2020-36714 | brizy (WordPress plugin) | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function | high | 7.4 | 1% |
| CVE-2024-13752 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | medium | 6.5 | 1% |
| CVE-2022-3096 | wp-total-hacks (WordPress plugin) | The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allo | medium | 5.4 | 1% |
| CVE-2023-4282 | embedpress (WordPress plugin) | The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' | medium | 5.4 | 1% |
| CVE-2023-2353 | chp-ads-block-detector (WordPress plugin) | The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability c | medium | 4.3 | 1% |
| CVE-2024-1318 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unaut | medium | 6.5 | 1% |