Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-56341 | wwbn/avideo | AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records | high | 7.5 | 0% |
| CVE-2023-2562 | gallery-metabox (WordPress plugin) | The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox func | medium | 4.3 | 0% |
| CVE-2024-5541 | ibtana-visual-editor (WordPress plugin) | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.3 | 0% |
| CVE-2024-0766 | envo-elementor-for-woocommerce (WordPress plugin) | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi | medium | 4.3 | 0% |
| CVE-2023-6496 | manage-notification-emails (WordPress plugin) | The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via | medium | 5.3 | 0% |
| CVE-2026-46337 | wwbn/avideo | AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` | medium | 5.3 | 0% |
| CVE-2024-1645 | mollie-forms (WordPress plugin) | The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrati | medium | 4.3 | 0% |
| CVE-2024-2098 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protec | high | 7.5 | 0% |
| CVE-2023-2757 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' | high | 7.4 | 0% |
| CVE-2023-6369 | export-wp-page-to-static-html (WordPress plugin) | The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a mi | medium | 5.4 | 0% |
| CVE-2023-5525 | limit-login-attempts-reloaded (WordPress plugin) | The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing | medium | 4.3 | 0% |
| CVE-2023-5737 | backup-and-migration (WordPress plugin) | The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as S | medium | 4.3 | 0% |
| CVE-2024-3869 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-0236 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unaut | medium | 5.3 | 0% |
| CVE-2024-5489 | custom-font-uploader (WordPress plugin) | The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2024-12876 | golo (WordPress plugin) | The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions | critical | 9.8 | 0% |
| CVE-2026-27836 | thorsten/phpmyfaq | phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint | high | 7.5 | 0% |
| CVE-2024-45131 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 5.4 | 0% |
| CVE-2024-13229 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing c | medium | 4.3 | 0% |
| CVE-2024-1492 | wpify-woo (WordPress plugin) | The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to | medium | 5.3 | 0% |
| CVE-2024-27915 | sulu/sulu | Sulu grants access to pages regardless of role permissions | medium | 6.8 | 0% |
| CVE-2024-10530 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2024-1092 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unaut | medium | 4.3 | 0% |
| CVE-2024-3606 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due | medium | 4.3 | 0% |
| CVE-2023-6751 | hostinger (WordPress plugin) | The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function pu | high | 7.3 | 0% |
| CVE-2025-24437 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 5.4 | 0% |
| CVE-2026-52825 | kimai/kimai | Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Vis | medium | 0.0 | 0% |
| CVE-2026-81892 | easycorp/easyadmin-bundle | EasyAdmin custom-action dispatcher bypasses access_control on other routes | high | 8.1 | 0% |
| CVE-2024-9586 | linkz-ai (WordPress plugin) | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' a | medium | 6.5 | 0% |
| CVE-2026-33501 | wwbn/avideo | AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin | medium | 5.3 | 0% |
| CVE-2022-3999 | woocommerce-shipping (WordPress plugin) | The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authent | high | 8.1 | 0% |
| CVE-2024-11069 | wordpress-gdpr (WordPress plugin) | The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_ | medium | 6.5 | 0% |
| CVE-2024-1370 | maintenance-page (WordPress plugin) | The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_do | medium | 5.3 | 0% |
| CVE-2025-1402 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | medium | 5.3 | 0% |
| CVE-2024-39323 | aimeos/ai-admin-graphql | aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account | high | 8.2 | 0% |
| CVE-2024-0972 | buddypress-members-only (WordPress plugin) | The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 | medium | 5.3 | 0% |
| CVE-2025-5953 | hrm (WordPress plugin) | The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_ | high | 8.8 | 0% |
| CVE-2025-55741 | unopim/unopim | UnoPim has Broken Access Control | high | 8.1 | 0% |
| CVE-2023-2547 | feather-login-page (WordPress plugin) | The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' | medium | 5.4 | 0% |
| CVE-2023-5711 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info( | medium | 4.3 | 0% |
| CVE-2026-56828 | shopper/framework | Shopper: privilege escalation via improper Livewire admin component authorization | high | 8.8 | 0% |
| CVE-2024-1733 | word-replacer-ultra (WordPress plugin) | The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the word_ | medium | 5.3 | 0% |
| CVE-2024-3216 | print-invoices-packing-slip-labels-for-woocommerce (WordPress plugin) | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modificat | medium | 5.3 | 0% |
| CVE-2023-5714 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs( | medium | 4.3 | 0% |
| CVE-2024-1126 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2024-1690 | woo-wallet (WordPress plugin) | The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2023-6733 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 6.5 | 0% |
| CVE-2024-1763 | wp-social (WordPress plugin) | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap | medium | 6.5 | 0% |
| CVE-2026-57570 | backpack/crud | Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation | medium | 6.5 | 0% |
| CVE-2024-10216 | wp-user-manager (WordPress plugin) | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |