Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-24751 | derhansen/sf_event_mgt | derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module | medium | 4.3 | 0% |
| CVE-2023-2414 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 5.4 | 0% |
| CVE-2026-49274 | getkirby/cms | Kirby: `pages.access` permission is not checked in the pages picker for parent pages | medium | 0.0 | 0% |
| CVE-2020-36667 | backup (WordPress plugin) | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, | medium | 5.4 | 0% |
| CVE-2023-3869 | wpdiscuz (WordPress plugin) | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComme | medium | 5.3 | 0% |
| CVE-2023-3998 | wpdiscuz (WordPress plugin) | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate fu | medium | 5.3 | 0% |
| CVE-2024-39322 | aimeos/ai-admin-jsonadm | aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records | medium | 5.5 | 0% |
| CVE-2024-5939 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing cap | medium | 5.3 | 0% |
| CVE-2024-41964 | getkirby/cms | Kirby has insufficient permission checks in the language settings | high | 8.1 | 0% |
| CVE-2023-6600 | host-webfonts-local (WordPress plugin) | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stor | high | 8.6 | 0% |
| CVE-2024-7032 | clover-online-orders (WordPress plugin) | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ' | medium | 6.5 | 0% |
| CVE-2024-13719 | pepro-ultimate-invoice (WordPress plugin) | The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2 | medium | 5.3 | 0% |
| CVE-2024-10900 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 6.5 | 0% |
| CVE-2024-9189 | eu-vat-for-woocommerce (WordPress plugin) | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch | medium | 5.3 | 0% |
| CVE-2025-31481 | api-platform/core, api-platform/graphql | GraphQL query operations security can be bypassed | high | 7.5 | 0% |
| CVE-2024-2107 | blossom-spa (WordPress theme) | The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generate | medium | 5.8 | 0% |
| CVE-2026-48008 | shopware/core, shopware/platform | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass | medium | 6.5 | 0% |
| CVE-2023-6696 | popup-builder (WordPress plugin) | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of | high | 8.1 | 0% |
| CVE-2024-1095 | control-block-patterns (WordPress plugin) | The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a mi | medium | 5.3 | 0% |
| CVE-2024-1122 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of da | medium | 5.3 | 0% |
| CVE-2024-11712 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access | medium | 5.3 | 0% |
| CVE-2024-13800 | convertplus (WordPress plugin) | The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missin | high | 8.1 | 0% |
| CVE-2024-43431 | moodle/moodle | Moodle's IDOR in badges allows deletion of arbitrary badges | high | 7.5 | 0% |
| CVE-2021-24993 | ultimate-product-catalog (WordPress plugin) | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could al | medium | 6.5 | 0% |
| CVE-2023-5251 | grid-plus (WordPress plugin) | The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on | medium | 5.4 | 0% |
| CVE-2023-5713 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_va | medium | 4.3 | 0% |
| CVE-2023-5710 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants | medium | 4.3 | 0% |
| CVE-2024-1904 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts | medium | 4.3 | 0% |
| CVE-2022-3911 | iubenda-cookie-law-solution (WordPress plugin) | The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options | high | 8.8 | 0% |
| CVE-2023-2716 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2023-5314 | wp-extra (WordPress plugin) | The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2022-4972 | download-monitor (WordPress plugin) | The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes | high | 7.5 | 0% |
| CVE-2024-5940 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 6.5 | 0% |
| CVE-2024-13364 | adthrive-ads (WordPress plugin) | The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() an | medium | 5.3 | 0% |
| CVE-2024-11715 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access | medium | 4.8 | 0% |
| CVE-2023-2275 | wcfm-marketplace-rest-api (WordPress plugin) | The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data du | medium | 4.3 | 0% |
| CVE-2024-10591 | makewebbetter-hubspot-for-woocommerce (WordPress plugin) | The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable | high | 8.8 | 0% |
| CVE-2024-1136 | responsive-coming-soon (WordPress plugin) | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented U | medium | 5.3 | 0% |
| CVE-2026-28696 | craftcms/cms | Craft CMS has IDOR via GraphQL @parseRefs | high | 0.0 | 0% |
| CVE-2026-52822 | kimai/kimai | Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation | medium | 0.0 | 0% |
| CVE-2026-52828 | kimai/kimai | Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access | medium | 0.0 | 0% |
| CVE-2024-3553 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missin | medium | 6.5 | 0% |
| CVE-2021-4447 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to | high | 8.8 | 0% |
| CVE-2025-2110 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss | high | 8.8 | 0% |
| CVE-2024-13656 | click-mag (WordPress theme) | The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lea | high | 8.1 | 0% |
| CVE-2026-54180 | backpack/crud | Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) | high | 7.6 | 0% |
| CVE-2025-3876 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP vali | high | 8.8 | 0% |
| CVE-2022-3881 | wptools (WordPress plugin) | The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin b | medium | 5.7 | 0% |
| CVE-2024-12071 | evergreen-content-poster (WordPress plugin) | The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized l | medium | 5.3 | 0% |
| CVE-2024-10533 | wp-whatsapp (WordPress plugin) | The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install | medium | 4.3 | 0% |