Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2867 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2024-9530 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 | medium | 4.3 | 0% |
| CVE-2024-6757 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versio | medium | 4.3 | 0% |
| CVE-2024-9540 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2024-1245 | concrete5/concrete5 | Concrete CMS vulnerable to stored XSS in file tags and description attributes | low | 2.4 | 0% |
| CVE-2025-30150 | shopware/core, shopware/platform | Shopware 6 allows attackers to check for registered accounts through the store-api | medium | 5.3 | 0% |
| CVE-2024-10548 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via | medium | 6.5 | 0% |
| CVE-2026-33761 | wwbn/avideo | AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings | medium | 5.3 | 0% |
| CVE-2025-65657 | feehi/cms | FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management | medium | 6.5 | 0% |
| CVE-2024-6455 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due | medium | 5.3 | 0% |
| CVE-2024-6544 | custom-post-limits (WordPress plugin) | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due t | medium | 5.3 | 0% |
| CVE-2024-13691 | uncode (WordPress theme) | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' functio | medium | 6.5 | 0% |
| CVE-2025-2252 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Expo | medium | 5.3 | 0% |
| CVE-2026-25509 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to User Email Enumeration via Password Reset Flow | medium | 5.3 | 0% |
| CVE-2024-39912 | web-auth/webauthn-framework, web-auth/webauthn-lib | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames | medium | 5.3 | 0% |
| CVE-2026-32935 | phpseclib/phpseclib | phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack | high | 0.0 | 0% |
| CVE-2026-62998 | redaxo/source | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration | medium | 4.3 | 0% |
| CVE-2023-47639 | api-platform/core | API Platform Core can leak exceptions message that may contain sensitive information | medium | 5.3 | 0% |
| CVE-2025-2331 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u | medium | 5.3 | 0% |
| CVE-2026-47743 | shopper/framework | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | high | 8.7 | 0% |
| CVE-2025-0764 | wpforo (WordPress plugin) | The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of th | medium | 6.5 | 0% |
| CVE-2026-55375 | jleehr/canto-saas-api | canto-saas-api: OAuth credentials exposed in URL query string and exception messages | medium | 5.3 | 0% |
| CVE-2024-40633 | sylius/sylius | Sylius has a security vulnerability via adjustments API endpoint | high | 7.5 | 0% |
| CVE-2024-13451 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | medium | 5.3 | 0% |
| CVE-2024-8902 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13 | medium | 4.3 | 0% |
| CVE-2024-8913 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2024-48896 | moodle/moodle | Moodle leaks user names | medium | 4.3 | 0% |
| CVE-2024-10360 | move-addons (WordPress plugin) | The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3 | medium | 4.3 | 0% |
| CVE-2024-6553 | wp-meteor (WordPress plugin) | The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2024-6571 | imageseo (WordPress plugin) | The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions u | medium | 5.3 | 0% |
| CVE-2024-56526 | oxid-esales/oxideshop-ce, oxid-esales/oxideshop-metapackage-ce, oxid-esales/smarty-component | OXID eShop May Display User Information | high | 7.5 | 0% |
| CVE-2026-71293 | statamic/cms | Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering | medium | 6.2 | 0% |
| CVE-2026-67354 | guzzlehttp/guzzle | Guzzle: URI fragments disclosed in redirect Referer headers | medium | 5.9 | 0% |
| CVE-2026-67339 | guzzlehttp/guzzle | Guzzle: Proxy-Authorization headers can be sent to origin servers | medium | 5.3 | 0% |
| CVE-2025-13785 | yungifez/skuul | Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images | medium | 4.3 | 0% |
| CVE-2026-34970 | mantisbt/mantisbt | MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked | medium | 0.0 | 0% |
| CVE-2024-33996 | moodle/moodle | Moodle broken access control when setting calendar event type | medium | 6.2 | 0% |
| CVE-2025-2228 | responsive-addons-for-elementor (WordPress plugin) | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive I | medium | 5.7 | 0% |
| CVE-2025-12468 | wp-marketing-automations (WordPress plugin) | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive I | medium | 5.3 | 0% |
| CVE-2026-35452 | wwbn/avideo | AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php | medium | 5.3 | 0% |
| CVE-2024-12560 | button-block (WordPress plugin) | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in | medium | 4.3 | 0% |
| CVE-2024-12584 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 4.3 | 0% |
| CVE-2026-67355 | guzzlehttp/guzzle | Guzzle: Host-only cookie scope is not preserved | medium | 5.9 | 0% |
| CVE-2025-0958 | ultimate-auction (WordPress plugin) | The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and | medium | 5.4 | 0% |
| CVE-2025-0318 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | 0% |
| CVE-2024-9627 | green-wp-telegram-bot-by-teplitsa (WordPress plugin) | The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization check | high | 8.6 | 0% |
| CVE-2024-25119 | typo3/cms-core | TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key | medium | 4.9 | 0% |
| CVE-2025-67857 | moodle/moodle | Moodle Inserts Sensitive Information Into Sent Data | medium | 4.3 | 0% |
| CVE-2026-34579 | mantisbt/mantisbt | MantisBT has an authorization bypass in private issue monitoring | medium | 0.0 | 0% |
| CVE-2024-2753 | concrete5/concrete5 | Concrete CMS Stored XSS on the calendar color settings screen | low | 2.0 | 0% |