Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-3952 | projectopia-core (WordPress plugin) | The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a de | high | 8.1 | 0% |
| CVE-2021-25013 | qubely (WordPress plugin) | The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does n | medium | 6.5 | 0% |
| CVE-2022-1570 | files-download-delay (WordPress plugin) | The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could a | medium | 6.5 | 0% |
| CVE-2022-0345 | customize-wordpress-emails-and-alerts (WordPress plugin) | The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users | medium | 4.3 | 0% |
| CVE-2022-1092 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowi | medium | 4.3 | 0% |
| CVE-2024-0595 | awesome-support (WordPress plugin) | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capabil | medium | 4.3 | 0% |
| CVE-2024-1562 | wc-gsheetconnector (WordPress plugin) | The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.3 | 0% |
| CVE-2024-1089 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-1285 | page-builder-sandwich (WordPress plugin) | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data | medium | 6.5 | 0% |
| CVE-2024-1093 | change-memory-limit (WordPress plugin) | The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the adm | medium | 5.3 | 0% |
| CVE-2024-1178 | sportspress (WordPress plugin) | The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-7605 | helloasso (WordPress plugin) | The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' fun | medium | 4.3 | 0% |
| CVE-2024-8350 | uncanny-groups-for-learndash (WordPress plugin) | The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm | low | 2.7 | 0% |
| CVE-2026-52821 | kimai/kimai | Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects | medium | 0.0 | 0% |
| CVE-2026-54005 | getkirby/cms | Kirby: `pages.access` permission is not checked in the `site/find` REST API route | high | 0.0 | 0% |
| CVE-2026-71415 | getkirby/cms | Kirby: File upload permissions are not checked during processing of chunk data | high | 0.0 | 0% |
| CVE-2021-24968 | ultimate-faq (WordPress plugin) | The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome | medium | 5.7 | 0% |
| CVE-2021-25011 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, | medium | 5.7 | 0% |
| CVE-2021-25116 | enqueue-anything (WordPress plugin) | The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does no | medium | 6.5 | 0% |
| CVE-2024-0836 | review-schema (WordPress plugin) | The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data | medium | 4.3 | 0% |
| CVE-2026-28685 | kimai/kimai | Kimai's API invoice endpoint missing customer-level access control (IDOR) | medium | 6.5 | 0% |
| CVE-2024-1502 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabi | medium | 5.4 | 0% |
| CVE-2023-6959 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-0369 | bulk-edit-post-titles (WordPress plugin) | The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b | medium | 4.3 | 0% |
| CVE-2024-0370 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-0371 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-0797 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |
| CVE-2024-12316 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_a | medium | 5.3 | 0% |
| CVE-2024-8513 | qa-heatmap-analytics (WordPress plugin) | The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized mod | medium | 5.3 | 0% |
| CVE-2024-1368 | wp-page-duplicator (WordPress plugin) | The Page Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplica | medium | 5.3 | 0% |
| CVE-2024-1516 | wp-e-commerce (WordPress plugin) | The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_f | medium | 5.3 | 0% |
| CVE-2024-13343 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_a | high | 8.8 | 0% |
| CVE-2025-1508 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data | medium | 5.3 | 0% |
| CVE-2024-12164 | wpsyncsheets-wpforms (WordPress plugin) | The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data | medium | 4.3 | 0% |
| CVE-2020-36702 | spectra (WordPress plugin) | The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14 | medium | 5.5 | 0% |
| CVE-2021-4445 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. Thi | medium | 6.5 | 0% |
| CVE-2026-85990 | leantime/leantime | Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods | high | 8.8 | 0% |
| CVE-2025-59022 | typo3/cms-recycler | TYPO3 CMS Allows Broken Access Control in Recycler Module | high | 0.0 | 0% |
| CVE-2024-13654 | zoxpress (WordPress theme) | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a | high | 8.1 | 0% |
| CVE-2023-22488 | flarum/core | Flarum notifications can leak restricted content | medium | 6.8 | 0% |
| CVE-2026-76089 | verbb/formie | Formie: Missing authorization on sent notification resend modal exposes submission PII | high | 7.7 | 0% |
| CVE-2020-36840 | mp-timetable (WordPress plugin) | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check o | high | 7.3 | 0% |
| CVE-2026-64662 | statamic/cms | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries | medium | 6.5 | 0% |
| CVE-2024-13783 | formcraft (WordPress plugin) | The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in a | medium | 4.3 | 0% |
| CVE-2025-31686 | goalgorilla/open_social | Drupal Open Social Missing Authorization vulnerability | high | 8.1 | 0% |
| CVE-2019-25215 | ari-adminer (WordPress plugin) | The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the | high | 7.3 | 0% |
| CVE-2022-2276 | wp-edit-menu (WordPress plugin) | The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated att | medium | 4.3 | 0% |
| CVE-2025-5835 | droip (WordPress plugin) | The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_ | high | 8.8 | 0% |
| CVE-2026-44010 | craftcms/cms | Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure | high | 0.0 | 0% |
| CVE-2024-9829 | download-plugin (WordPress plugin) | The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handl | medium | 6.5 | 0% |