Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3869 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-0236 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unaut | medium | 5.3 | 0% |
| CVE-2024-5489 | custom-font-uploader (WordPress plugin) | The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2024-12876 | golo (WordPress plugin) | The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions | critical | 9.8 | 0% |
| CVE-2026-27836 | thorsten/phpmyfaq | phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint | high | 7.5 | 0% |
| CVE-2024-13229 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing c | medium | 4.3 | 0% |
| CVE-2024-1492 | wpify-woo (WordPress plugin) | The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to | medium | 5.3 | 0% |
| CVE-2024-10530 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2024-1092 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unaut | medium | 4.3 | 0% |
| CVE-2024-3606 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due | medium | 4.3 | 0% |
| CVE-2023-6751 | hostinger (WordPress plugin) | The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function pu | high | 7.3 | 0% |
| CVE-2026-52825 | kimai/kimai | Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Vis | medium | 0.0 | 0% |
| CVE-2026-81892 | easycorp/easyadmin-bundle | EasyAdmin custom-action dispatcher bypasses access_control on other routes | high | 8.1 | 0% |
| CVE-2024-9586 | linkz-ai (WordPress plugin) | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' a | medium | 6.5 | 0% |
| CVE-2026-33501 | wwbn/avideo | AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin | medium | 5.3 | 0% |
| CVE-2022-3999 | woocommerce-shipping (WordPress plugin) | The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authent | high | 8.1 | 0% |
| CVE-2024-11069 | wordpress-gdpr (WordPress plugin) | The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_ | medium | 6.5 | 0% |
| CVE-2024-1370 | maintenance-page (WordPress plugin) | The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_do | medium | 5.3 | 0% |
| CVE-2025-1402 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | medium | 5.3 | 0% |
| CVE-2024-0972 | buddypress-members-only (WordPress plugin) | The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 | medium | 5.3 | 0% |
| CVE-2025-5953 | hrm (WordPress plugin) | The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_ | high | 8.8 | 0% |
| CVE-2025-55741 | unopim/unopim | UnoPim has Broken Access Control | high | 8.1 | 0% |
| CVE-2023-2547 | feather-login-page (WordPress plugin) | The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' | medium | 5.4 | 0% |
| CVE-2023-5711 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info( | medium | 4.3 | 0% |
| CVE-2026-56828 | shopper/framework | Shopper: privilege escalation via improper Livewire admin component authorization | high | 8.8 | 0% |
| CVE-2024-1733 | word-replacer-ultra (WordPress plugin) | The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the word_ | medium | 5.3 | 0% |
| CVE-2024-3216 | print-invoices-packing-slip-labels-for-woocommerce (WordPress plugin) | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modificat | medium | 5.3 | 0% |
| CVE-2023-5714 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs( | medium | 4.3 | 0% |
| CVE-2024-1126 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2024-1690 | woo-wallet (WordPress plugin) | The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2023-6733 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 6.5 | 0% |
| CVE-2024-1763 | wp-social (WordPress plugin) | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap | medium | 6.5 | 0% |
| CVE-2026-57570 | backpack/crud | Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation | medium | 6.5 | 0% |
| CVE-2024-10216 | wp-user-manager (WordPress plugin) | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2024-11271 | wp-webinarsystem (WordPress plugin) | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on | high | 8.8 | 0% |
| CVE-2025-1657 | ulisting (WordPress plugin) | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object In | high | 8.8 | 0% |
| CVE-2024-10003 | rover-idx (WordPress plugin) | The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on | medium | 6.3 | 0% |
| CVE-2024-5087 | minimal-coming-soon-maintenance-mode (WordPress plugin) | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili | medium | 6.3 | 0% |
| CVE-2024-1584 | wp-analytify (WordPress plugin) | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized modifi | medium | 5.3 | 0% |
| CVE-2023-4947 | woocommerce-ean-payment-gateway (WordPress plugin) | The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2025-31681 | drupal/alogin | This module allows a site to setup two factor authentication via QR code using authenticator applications on mobile devi | critical | 9.8 | 0% |
| CVE-2025-31691 | drupal/oauth2_server | Provides OAuth2 server functionality based on the oauth2-server-php library. The module does not consistently enforce a | critical | 9.8 | 0% |
| CVE-2023-2555 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 4.3 | 0% |
| CVE-2023-2556 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 4.3 | 0% |
| CVE-2024-6626 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due | medium | 5.3 | 0% |
| CVE-2023-5712 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_va | medium | 4.3 | 0% |
| CVE-2024-2844 | easy-appointments (WordPress plugin) | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the aja | medium | 4.3 | 0% |
| CVE-2024-6698 | wp-fundraising-donation (WordPress plugin) | The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the pl | high | 8.8 | 0% |
| CVE-2024-1288 | schema-\&-structured-data-for-wp-\&-amp (WordPress plugin) | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2024-3243 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on t | medium | 4.3 | 0% |