Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4390 | depicter (WordPress plugin) | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and inclu | medium | 6.5 | 1% |
| CVE-2024-1677 | a4-barcode-generator (WordPress plugin) | The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to unauth | medium | 6.3 | 1% |
| CVE-2023-0404 | events-made-easy (WordPress plugin) | The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions relat | medium | 5.4 | 1% |
| CVE-2023-3213 | wp-mail-smtp (WordPress plugin) | The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_pag | medium | 5.3 | 1% |
| CVE-2023-2084 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get fu | medium | 4.3 | 1% |
| CVE-2026-76086 | verbb/formie | Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials | high | 8.5 | 1% |
| CVE-2024-1177 | wp-club-manager (WordPress plugin) | The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 1% |
| CVE-2022-45353 | betheme (WordPress plugin) | Broken Access Control in Betheme theme <= 26.6.1 on WordPress. | medium | 4.3 | 1% |
| CVE-2024-10402 | forminator-forms (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a m | high | 7.5 | 1% |
| CVE-2023-6855 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized m | medium | 5.3 | 1% |
| CVE-2024-0702 | oliver-pos (WordPress plugin) | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability check | high | 7.3 | 1% |
| CVE-2023-25715 | gamipress (WordPress plugin) | Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in Wo | medium | 5.4 | 1% |
| CVE-2023-2066 | bulletin-announcements (WordPress plugin) | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to unauthorized access and modification of data due to | medium | 6.3 | 1% |
| CVE-2026-56825 | shopper/framework | Shopper: Missing authorization on product removal actions in CollectionProducts component | high | 8.1 | 1% |
| CVE-2026-56827 | shopper/framework | Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of | high | 8.1 | 1% |
| CVE-2026-56829 | shopper/framework | Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component | high | 8.1 | 1% |
| CVE-2023-4024 | radio-player (WordPress plugin) | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_pla | medium | 5.3 | 1% |
| CVE-2023-37890 | kb-support (WordPress plugin) | Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Proper | medium | 4.3 | 1% |
| CVE-2024-6120 | sparkle-demo-importer (WordPress plugin) | The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability | medium | 6.5 | 1% |
| CVE-2023-3053 | page-builder-by-azexo (WordPress plugin) | The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ' | medium | 5.4 | 1% |
| CVE-2023-1844 | subscribe2 (WordPress plugin) | The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sendi | medium | 4.3 | 1% |
| CVE-2023-2764 | draw-attention (WordPress plugin) | The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_set | medium | 4.3 | 1% |
| CVE-2023-2869 | wp-members (WordPress plugin) | The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the | medium | 4.3 | 1% |
| CVE-2023-3957 | navz-photo-gallery (WordPress plugin) | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on th | medium | 4.3 | 1% |
| CVE-2023-4792 | duplicate-post-page-menu-custom-post-type (WordPress plugin) | The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missin | medium | 4.3 | 1% |
| CVE-2024-1158 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | medium | 4.3 | 1% |
| CVE-2024-12171 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capabili | high | 8.8 | 1% |
| CVE-2020-36831 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on | medium | 5.0 | 1% |
| CVE-2023-5644 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role | high | 7.6 | 0% |
| CVE-2022-2350 | disable-user-login (WordPress plugin) | The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unaut | medium | 5.3 | 0% |
| CVE-2026-52819 | kimai/kimai | Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the targ | medium | 0.0 | 0% |
| CVE-2026-54004 | getkirby/cms | Kirby: Access to files of top-level drafts is not protected by permissions | medium | 0.0 | 0% |
| CVE-2022-46158 | prestashop/prestashop | PrestaShop has potential Information exposure in the upload directory | medium | 5.3 | 0% |
| CVE-2026-75837 | getgrav/grav | Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin | critical | 9.1 | 0% |
| CVE-2022-0833 | church-admin (WordPress plugin) | The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allo | medium | 4.3 | 0% |
| CVE-2023-6279 | sites-library (WordPress plugin) | The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, su | high | 7.1 | 0% |
| CVE-2022-40223 | searchwp (WordPress plugin) | Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change. | medium | 5.4 | 0% |
| CVE-2024-0617 | woo-product-category-discount (WordPress plugin) | The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2025-0968 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 0% |
| CVE-2022-3923 | activecampaign-for-woocommerce (WordPress plugin) | The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJ | medium | 4.3 | 0% |
| CVE-2024-1108 | plugin-groups (WordPress plugin) | The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_ini | medium | 6.5 | 0% |
| CVE-2024-1381 | page-builder-sandwich (WordPress plugin) | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in | medium | 6.5 | 0% |
| CVE-2026-49976 | snipe/snipe-it | Snipe-IT Vulnerable to User Account Escalation via CSV Import | medium | 6.5 | 0% |
| CVE-2022-40218 | advance-product-search (WordPress plugin) | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/ | medium | 6.5 | 0% |
| CVE-2022-45803 | gutenberg-forms (WordPress plugin) | Missing Authorization vulnerability in Nikolay Strikhar WordPress Form Builder Plugin – Gutenberg Forms.This issue affects WordPress Form Bu | medium | 6.5 | 0% |
| CVE-2024-13231 | uber-grid (WordPress plugin) | The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 0% |
| CVE-2022-4385 | intuitive-custom-post-order (WordPress plugin) | The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowin | medium | 4.3 | 0% |
| CVE-2023-1027 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCateg | medium | 4.3 | 0% |
| CVE-2023-22728 | silverstripe/framework | Missing permission check of canView in GridFieldPrintButton | medium | 4.3 | 0% |
| CVE-2024-8102 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to pr | high | 8.8 | 0% |