Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-11996 | find-unused-images (WordPress plugin) | The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_i | medium | 5.3 | 0% |
| CVE-2024-10537 | wp-user-manager (WordPress plugin) | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing c | medium | 4.3 | 0% |
| CVE-2024-11583 | borderless (WordPress plugin) | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss | medium | 4.3 | 0% |
| CVE-2024-1860 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unautho | medium | 6.5 | 0% |
| CVE-2023-6731 | wp-show-posts (WordPress plugin) | The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX funct | medium | 4.3 | 0% |
| CVE-2024-1133 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due | medium | 4.3 | 0% |
| CVE-2024-11936 | zox-news (WordPress theme) | The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing c | high | 8.8 | 0% |
| CVE-2024-12129 | royal-core (WordPress plugin) | The Royal Core plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missin | high | 8.8 | 0% |
| CVE-2024-0238 | eventon (WordPress plugin) | The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and do | medium | 6.1 | 0% |
| CVE-2025-1766 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data | medium | 5.3 | 0% |
| CVE-2025-2789 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for Word | medium | 5.3 | 0% |
| CVE-2024-0983 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-0984 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-3961 | convertkit (WordPress plugin) | The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modific | medium | 5.3 | 0% |
| CVE-2024-1778 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 4.3 | 0% |
| CVE-2024-3609 | reviewx (WordPress plugin) | The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a m | medium | 4.3 | 0% |
| CVE-2023-3204 | materialis (WordPress theme) | The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due | medium | 6.5 | 0% |
| CVE-2023-2494 | go-pricing (WordPress plugin) | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missin | medium | 4.6 | 0% |
| CVE-2024-13447 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_bookin | medium | 4.3 | 0% |
| CVE-2025-1667 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on | high | 8.8 | 0% |
| CVE-2024-8552 | download-monitor (WordPress plugin) | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable | medium | 4.3 | 0% |
| CVE-2025-4179 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() | high | 7.3 | 0% |
| CVE-2024-1687 | woo-thank-you-page-customizer (WordPress plugin) | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcod | medium | 5.4 | 0% |
| CVE-2025-2816 | page-views-count (WordPress plugin) | The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a mi | high | 8.1 | 0% |
| CVE-2024-1937 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'u | high | 7.1 | 0% |
| CVE-2024-5459 | food-and-drink-menu (WordPress plugin) | The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check | medium | 4.3 | 0% |
| CVE-2025-4177 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() func | medium | 5.3 | 0% |
| CVE-2022-2377 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated user | medium | 4.3 | 0% |
| CVE-2022-2382 | product-slider-for-woocommerce (WordPress plugin) | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-2389 | funnelkit-automations (WordPress plugin) | The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before | medium | 4.3 | 0% |
| CVE-2026-44176 | getkirby/cms | Kirby CMS's `pages.access` permission is not checked during rendering of page drafts | medium | 0.0 | 0% |
| CVE-2026-45334 | getkirby/cms | Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions | medium | 0.0 | 0% |
| CVE-2024-0452 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_ | medium | 5.0 | 0% |
| CVE-2024-0453 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_ | medium | 5.0 | 0% |
| CVE-2024-7429 | zotpress (WordPress plugin) | The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_proce | medium | 4.3 | 0% |
| CVE-2024-9364 | wp-sendgrid-mailer (WordPress plugin) | The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mail | medium | 4.3 | 0% |
| CVE-2024-12821 | media-manager (WordPress plugin) | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation | high | 8.8 | 0% |
| CVE-2025-2103 | soundrise (WordPress plugin) | The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a m | high | 8.8 | 0% |
| CVE-2024-1042 | wp-radio (WordPress plugin) | The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to unauthorized modification of da | medium | 6.4 | 0% |
| CVE-2024-0828 | play-ht (WordPress plugin) | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to unauthorized access of functio | medium | 5.4 | 0% |
| CVE-2024-9587 | linkz-ai (WordPress plugin) | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' f | medium | 5.4 | 0% |
| CVE-2024-11852 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulner | medium | 4.3 | 0% |
| CVE-2024-3893 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a | medium | 4.3 | 0% |
| CVE-2024-5665 | easy-login-woocommerce (WordPress plugin) | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capa | medium | 4.3 | 0% |
| CVE-2024-6033 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due | medium | 4.3 | 0% |
| CVE-2026-32268 | craftcms/azure-blob | Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability | high | 0.0 | 0% |
| CVE-2024-12719 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_aj | medium | 4.3 | 0% |
| CVE-2024-1861 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |
| CVE-2024-8771 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | medium | 4.3 | 0% |
| CVE-2026-33160 | craftcms/cms | Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL | low | 0.0 | 0% |