Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-11271 | wp-webinarsystem (WordPress plugin) | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on | high | 8.8 | 0% |
| CVE-2026-55460 | snipe/snipe-it | Snipe-IT has an authorization bypass on bulk editing users | high | 7.1 | 0% |
| CVE-2025-1657 | ulisting (WordPress plugin) | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object In | high | 8.8 | 0% |
| CVE-2024-10003 | rover-idx (WordPress plugin) | The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on | medium | 6.3 | 0% |
| CVE-2024-5087 | minimal-coming-soon-maintenance-mode (WordPress plugin) | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili | medium | 6.3 | 0% |
| CVE-2024-1584 | wp-analytify (WordPress plugin) | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized modifi | medium | 5.3 | 0% |
| CVE-2023-4947 | woocommerce-ean-payment-gateway (WordPress plugin) | The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2025-31681 | drupal/alogin | This module allows a site to setup two factor authentication via QR code using authenticator applications on mobile devi | critical | 9.8 | 0% |
| CVE-2025-31691 | drupal/oauth2_server | Provides OAuth2 server functionality based on the oauth2-server-php library. The module does not consistently enforce a | critical | 9.8 | 0% |
| CVE-2023-2555 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 4.3 | 0% |
| CVE-2023-2556 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 4.3 | 0% |
| CVE-2024-6626 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due | medium | 5.3 | 0% |
| CVE-2023-5712 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_va | medium | 4.3 | 0% |
| CVE-2024-2844 | easy-appointments (WordPress plugin) | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the aja | medium | 4.3 | 0% |
| CVE-2024-6698 | wp-fundraising-donation (WordPress plugin) | The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the pl | high | 8.8 | 0% |
| CVE-2024-1288 | schema-\&-structured-data-for-wp-\&-amp (WordPress plugin) | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2024-3243 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2025-3952 | projectopia-core (WordPress plugin) | The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a de | high | 8.1 | 0% |
| CVE-2021-25013 | qubely (WordPress plugin) | The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does n | medium | 6.5 | 0% |
| CVE-2022-1570 | files-download-delay (WordPress plugin) | The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could a | medium | 6.5 | 0% |
| CVE-2025-54267 | magento/community-edition, magento/project-community-edition | Magento vulnerable to privilege escalation due to incorrect authorization | medium | 6.5 | 0% |
| CVE-2022-0345 | customize-wordpress-emails-and-alerts (WordPress plugin) | The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users | medium | 4.3 | 0% |
| CVE-2022-1092 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowi | medium | 4.3 | 0% |
| CVE-2024-0595 | awesome-support (WordPress plugin) | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capabil | medium | 4.3 | 0% |
| CVE-2026-45075 | symfony/http-kernel, symfony/security-http, symfony/symfony | Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] | high | 0.0 | 0% |
| CVE-2024-1562 | wc-gsheetconnector (WordPress plugin) | The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.3 | 0% |
| CVE-2024-1089 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-39324 | aimeos/ai-admin-graphql | aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services | low | 3.8 | 0% |
| CVE-2024-1285 | page-builder-sandwich (WordPress plugin) | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data | medium | 6.5 | 0% |
| CVE-2024-1093 | change-memory-limit (WordPress plugin) | The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the adm | medium | 5.3 | 0% |
| CVE-2024-1178 | sportspress (WordPress plugin) | The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-7605 | helloasso (WordPress plugin) | The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' fun | medium | 4.3 | 0% |
| CVE-2024-8350 | uncanny-groups-for-learndash (WordPress plugin) | The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm | low | 2.7 | 0% |
| CVE-2026-45704 | pimcore/pimcore | Pimcore has a CustomReports Share Bypass | high | 0.0 | 0% |
| CVE-2026-52821 | kimai/kimai | Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects | medium | 0.0 | 0% |
| CVE-2026-54005 | getkirby/cms | Kirby: `pages.access` permission is not checked in the `site/find` REST API route | high | 0.0 | 0% |
| CVE-2026-71415 | getkirby/cms | Kirby: File upload permissions are not checked during processing of chunk data | high | 0.0 | 0% |
| CVE-2026-82395 | sulu/sulu | Sulu: Media move/update authorization bypass (IDOR) | medium | 0.0 | 0% |
| CVE-2021-24968 | ultimate-faq (WordPress plugin) | The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome | medium | 5.7 | 0% |
| CVE-2021-25011 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, | medium | 5.7 | 0% |
| CVE-2025-68129 | auth0/auth0-php | Auth0-PHP SDK has Improper Audience Validation | medium | 6.8 | 0% |
| CVE-2021-25116 | enqueue-anything (WordPress plugin) | The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does no | medium | 6.5 | 0% |
| CVE-2024-0836 | review-schema (WordPress plugin) | The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data | medium | 4.3 | 0% |
| CVE-2026-28685 | kimai/kimai | Kimai's API invoice endpoint missing customer-level access control (IDOR) | medium | 6.5 | 0% |
| CVE-2024-1502 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabi | medium | 5.4 | 0% |
| CVE-2023-6959 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-0369 | bulk-edit-post-titles (WordPress plugin) | The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b | medium | 4.3 | 0% |
| CVE-2024-0370 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-0371 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-0797 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |