Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-7727 | html5-video-player (WordPress plugin) | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missin | medium | 5.3 | 0% |
| CVE-2023-5385 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_c | medium | 4.3 | 0% |
| CVE-2023-5411 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2023-5417 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_u | medium | 4.3 | 0% |
| CVE-2023-5419 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2024-1053 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th | medium | 4.3 | 0% |
| CVE-2024-12184 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check o | medium | 5.3 | 0% |
| CVE-2026-34369 | wwbn/avideo | AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification | medium | 5.3 | 0% |
| CVE-2024-1340 | login-lockdown (WordPress plugin) | The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2026-48014 | shopware/core, shopware/platform | Shopware: Admin API ACL Bypass in Order State Transition Endpoints | medium | 6.5 | 0% |
| CVE-2026-56830 | shopper/framework | Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph) | medium | 6.5 | 0% |
| CVE-2024-0201 | product-expiry-for-woocommerce (WordPress plugin) | The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-9065 | wp-helper-lite (WordPress plugin) | The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whp_ | medium | 5.3 | 0% |
| CVE-2024-3627 | wheel-of-life (WordPress plugin) | The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of d | medium | 5.4 | 0% |
| CVE-2026-30885 | wwbn/avideo | AVideo has Unauthenticated IDOR - Playlist Information Disclosure | medium | 0.0 | 0% |
| CVE-2026-50284 | craftcms/cms | Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets | high | 0.0 | 0% |
| CVE-2024-5941 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to | medium | 5.4 | 0% |
| CVE-2024-1779 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2023-1928 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_prel | medium | 4.3 | 0% |
| CVE-2023-1929 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_purg | medium | 4.3 | 0% |
| CVE-2023-1930 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the wpfc_clear_ca | medium | 4.3 | 0% |
| CVE-2023-1931 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the deleteCssAndJsCac | medium | 4.3 | 0% |
| CVE-2023-2174 | badgeos (WordPress plugin) | The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_ | medium | 4.3 | 0% |
| CVE-2023-2284 | wp-security-audit-log (WordPress plugin) | The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2023-4948 | woocommerce-cvr-payment-gateway (WordPress plugin) | The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2023-6066 | wp-custom-widget-area (WordPress plugin) | The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callb | medium | 4.3 | 0% |
| CVE-2024-6621 | wp-rss-aggregator (WordPress plugin) | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2026-14793 | craftcms/cms | Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets | medium | 4.3 | 0% |
| CVE-2026-49205 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) | medium | 6.5 | 0% |
| CVE-2023-6876 | clever-fox (WordPress plugin) | The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a | medium | 5.4 | 0% |
| CVE-2024-4468 | salon-booking-system (WordPress plugin) | The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2024-6012 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2026-14794 | craftcms/cms | Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics | medium | 4.3 | 0% |
| CVE-2026-48492 | snipe/snipe-it | Snipe-IT's selectlist visibility is too permissive | medium | 0.0 | 0% |
| CVE-2026-35671 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: IDOR Account Takeover | high | 8.8 | 0% |
| CVE-2024-3942 | masterstudy-lms (WordPress plugin) | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modificat | medium | 6.3 | 0% |
| CVE-2022-3538 | webmaster-tools-verification (WordPress plugin) | The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing u | medium | 6.5 | 0% |
| CVE-2024-0451 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_c | medium | 5.0 | 0% |
| CVE-2023-7068 | print-invoices-packing-slip-labels-for-woocommerce (WordPress plugin) | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of | medium | 4.3 | 0% |
| CVE-2021-24790 | contact-form-advanced-database (WordPress plugin) | The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_d | medium | 4.3 | 0% |
| CVE-2025-31678 | drupal/ai | The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes. The module | high | 8.2 | 0% |
| CVE-2024-3600 | poll-maker (WordPress plugin) | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability ch | high | 7.2 | 0% |
| CVE-2022-3489 | wp-hide (WordPress plugin) | The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settin | medium | 5.3 | 0% |
| CVE-2024-1041 | wp-radio (WordPress plugin) | The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-12201 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when cr | medium | 4.3 | 0% |
| CVE-2024-5703 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | medium | 4.3 | 0% |
| CVE-2024-6491 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2025-2876 | melapress-login-security (WordPress plugin) | The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a | medium | 5.3 | 0% |
| CVE-2024-2619 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insu | medium | 5.0 | 0% |
| CVE-2024-10854 | buy-one-click-woocommerce (WordPress plugin) | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |