Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10078 | easy-post-types (WordPress plugin) | The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability | medium | 6.3 | 0% |
| CVE-2024-0237 | eventon (WordPress plugin) | The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing u | medium | 5.3 | 0% |
| CVE-2024-1798 | tutor-lms-migration-tool (WordPress plugin) | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tu | medium | 5.3 | 0% |
| CVE-2024-9583 | wp-rss-aggregator (WordPress plugin) | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functi | medium | 4.3 | 0% |
| CVE-2024-1123 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a miss | medium | 6.5 | 0% |
| CVE-2023-4025 | radio-player (WordPress plugin) | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_pla | medium | 5.3 | 0% |
| CVE-2023-4027 | radio-player (WordPress plugin) | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_set | medium | 5.3 | 0% |
| CVE-2024-12427 | multi-step-form (WordPress plugin) | The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_uploa | medium | 5.3 | 0% |
| CVE-2024-6824 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2024-9195 | whmcs-client-area (WordPress plugin) | The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalati | high | 8.8 | 0% |
| CVE-2026-76087 | verbb/formie | Formie: Unauthenticated users can overwrite incomplete submissions via submit action | high | 8.2 | 0% |
| CVE-2024-10717 | styler-for-ninja-forms-lite (WordPress plugin) | The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due | medium | 6.5 | 0% |
| CVE-2024-1044 | customer-reviews-for-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che | medium | 5.3 | 0% |
| CVE-2023-2557 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 4.3 | 0% |
| CVE-2023-2561 | gallery-metabox (WordPress plugin) | The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove | medium | 4.3 | 0% |
| CVE-2024-5685 | snipe/snipe-it | Snipe-IT allows users to promote or demote themselves or other users | high | 8.1 | 0% |
| CVE-2024-1385 | wp-stateless (WordPress plugin) | The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | high | 7.1 | 0% |
| CVE-2024-4566 | woolentor-addons (WordPress plugin) | The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss | high | 7.1 | 0% |
| CVE-2023-6742 | envira-gallery-lite (WordPress plugin) | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an im | medium | 4.3 | 0% |
| CVE-2024-1686 | woo-thank-you-page-customizer (WordPress plugin) | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all ver | medium | 4.3 | 0% |
| CVE-2024-1771 | total (WordPress theme) | The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sectio | medium | 4.3 | 0% |
| CVE-2024-1870 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ca | medium | 4.3 | 0% |
| CVE-2023-5386 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_d | medium | 6.5 | 0% |
| CVE-2024-0619 | payflex-payment-gateway (WordPress plugin) | The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 5.3 | 0% |
| CVE-2024-4858 | testimonials-carousel-elementor (WordPress plugin) | The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.3 | 0% |
| CVE-2024-7447 | funnelforms-free (WordPress plugin) | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to un | medium | 5.3 | 0% |
| CVE-2024-5053 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized | medium | 4.2 | 0% |
| CVE-2023-3999 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX ca | medium | 6.3 | 0% |
| CVE-2024-10535 | video-wc-gallery (WordPress plugin) | The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2024-8199 | reviews-feed (WordPress plugin) | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2023-5506 | imagemapper (WordPress plugin) | The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area | medium | 5.4 | 0% |
| CVE-2024-0596 | awesome-support (WordPress plugin) | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing | medium | 5.3 | 0% |
| CVE-2023-5387 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2023-5415 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2023-5416 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_d | medium | 4.3 | 0% |
| CVE-2024-13370 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 6.5 | 0% |
| CVE-2024-5861 | wp-easy-pay (WordPress plugin) | The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability che | medium | 5.3 | 0% |
| CVE-2023-7268 | artplacer-widget (WordPress plugin) | The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authentic | medium | 6.5 | 0% |
| CVE-2024-45689 | moodle/moodle | Moodle allows users to retrieve information they did not have permission to access | medium | 6.5 | 0% |
| CVE-2024-9697 | social-rocket (WordPress plugin) | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 5.3 | 0% |
| CVE-2026-33761 | wwbn/avideo | AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings | medium | 5.3 | 0% |
| CVE-2024-6455 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due | medium | 5.3 | 0% |
| CVE-2024-12614 | passwords-manager (WordPress plugin) | The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_ | high | 7.5 | 0% |
| CVE-2024-8432 | webba-booking-lite (WordPress plugin) | The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 4.3 | 0% |
| CVE-2023-6966 | the-moneytizer (WordPress plugin) | The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missin | high | 8.1 | 0% |
| CVE-2024-1639 | license-manager-for-woocommerce (WordPress plugin) | The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t | medium | 6.5 | 0% |
| CVE-2025-31685 | goalgorilla/open_social | Drupal Open Social Missing Authorization vulnerability | critical | 9.1 | 0% |
| CVE-2024-1175 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-13316 | scratch-win-giveaways-for-website-facebook (WordPress plugin) | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vu | medium | 5.3 | 0% |
| CVE-2024-9109 | flexible-shipping-ups (WordPress plugin) | The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a | medium | 4.3 | 0% |