Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-34744 | mantisbt/mantisbt | MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue | medium | 0.0 | 0% |
| CVE-2026-40194 | phpseclib/phpseclib | phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() | low | 3.7 | 0% |
| CVE-2024-2513 | wp-chat-app (WordPress plugin) | The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-12329 | essential-real-estate (WordPress plugin) | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pag | medium | 4.3 | 0% |
| CVE-2024-3178 | concrete5/concrete5 | Concrete CMS Cross-site Scripting (XSS) in the Advanced File Search Filter | low | 3.1 | 0% |
| CVE-2024-3179 | concrete5/concrete5 | Concrete CMS Stored XSS in the Custom Class page editing | low | 3.1 | 0% |
| CVE-2024-3180 | concrete5/concrete5 | Concrete CMS Stored XSS in blocks of type file | low | 3.1 | 0% |
| CVE-2024-3181 | concrete5/concrete5 | Concrete CMS Stored XSS in the Search Field | low | 3.1 | 0% |
| CVE-2026-56385 | craftcms/cms | Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata | low | 0.0 | 0% |
| CVE-2024-2226 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2026-57994 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ public FAQ APIs expose inactive FAQ content | medium | 5.3 | 0% |
| CVE-2024-11299 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the W | medium | 5.3 | 0% |
| CVE-2026-32265 | craftcms/aws-s3 | Amazon S3 for Craft CMS has an Information Disclosure vulnerability | medium | 0.0 | 0% |
| CVE-2026-32266 | craftcms/google-cloud | Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability | low | 0.0 | 0% |
| CVE-2025-8571 | concrete5/concrete5 | Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page | medium | 0.0 | 0% |
| CVE-2025-1063 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in | medium | 5.3 | 0% |
| CVE-2023-48714 | silverstripe/framework | Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter | medium | 4.3 | 0% |
| CVE-2024-34003 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 5.9 | 0% |
| CVE-2024-2650 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-10084 | contact-form-7-dynamic-text-extension (WordPress plugin) | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Basic Information Disclosure in all versions up to, and in | medium | 4.3 | 0% |
| CVE-2024-7063 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the | medium | 4.3 | 0% |
| CVE-2026-55212 | pimcore/studio-backend-bundle | Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation | high | 7.1 | 0% |
| CVE-2025-12426 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is | medium | 5.3 | 0% |
| CVE-2024-48900 | moodle/moodle | Moodle IDOR when accessing list of badge recipients | medium | 0.0 | 0% |
| CVE-2024-5969 | aiomatic (WordPress plugin) | The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and inclu | medium | 5.8 | 0% |
| CVE-2024-13537 | c9-blocks (WordPress plugin) | The C9 Blocks plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.7.7. This is due the plugin | medium | 5.3 | 0% |
| CVE-2026-33692 | wwbn/avideo | AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration | high | 7.5 | 0% |
| CVE-2024-2088 | social-networks-auto-poster-facebook-twitter-g (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | high | 8.5 | 0% |
| CVE-2026-48166 | filament/filament | Filament: Timing-based user enumeration on login page | medium | 5.3 | 0% |
| CVE-2024-10365 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2024-10319 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 4.3 | 0% |
| CVE-2024-10352 | magical-addons-for-elementor (WordPress plugin) | The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2024-9541 | news-kit-elementor-addons (WordPress plugin) | The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2 | medium | 4.3 | 0% |
| CVE-2024-9889 | elementinvader-addons-for-elementor (WordPress plugin) | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl | medium | 4.3 | 0% |
| CVE-2025-4523 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a | medium | 6.5 | 0% |
| CVE-2026-64664 | statamic/cms | Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence | medium | 4.3 | 0% |
| CVE-2024-6551 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and | medium | 5.3 | 0% |
| CVE-2024-47059 | mautic/core | Mautic allows users enumeration due to weak password login | medium | 4.3 | 0% |
| CVE-2024-2536 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HowTo block attributes in all | medium | 6.4 | 0% |
| CVE-2026-33041 | wwbn/avideo | AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php | medium | 5.3 | 0% |
| CVE-2025-3628 | moodle/moodle | Moodle reveals student identities through assignment submissions search on anonymous submissions | medium | 4.3 | 0% |
| CVE-2026-42552 | flightphp/core | Flight vulnerable to sensitive information disclosure via default error handler | high | 7.5 | 0% |
| CVE-2023-1789 | grumpydictator/firefly-iii | Firefly III vulnerable to improper input validation | medium | 5.9 | 0% |
| CVE-2026-43885 | wwbn/avideo | AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization | high | 0.0 | 0% |
| CVE-2024-13798 | post-grid (WordPress plugin) | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, an | medium | 5.3 | 0% |
| CVE-2026-55792 | craftcms/cms | Craft CMS: Sensitive File Disclosure / Server-Side File Read | medium | 0.0 | 0% |
| CVE-2024-43429 | moodle/moodle | Moodle has user information visibility control issues in gradebook reports | medium | 5.3 | 0% |
| CVE-2026-35449 | wwbn/avideo | AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php | medium | 5.3 | 0% |
| CVE-2024-11636 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which | medium | 4.8 | 0% |
| CVE-2026-56384 | craftcms/cms | Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission | medium | 0.0 | 0% |