Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-25274 | drupal/core | Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated | medium | 5.4 | 0% |
| CVE-2024-12316 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_a | medium | 5.3 | 0% |
| CVE-2024-8513 | qa-heatmap-analytics (WordPress plugin) | The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized mod | medium | 5.3 | 0% |
| CVE-2024-1368 | wp-page-duplicator (WordPress plugin) | The Page Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplica | medium | 5.3 | 0% |
| CVE-2024-1516 | wp-e-commerce (WordPress plugin) | The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_f | medium | 5.3 | 0% |
| CVE-2024-13343 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_a | high | 8.8 | 0% |
| CVE-2025-1508 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data | medium | 5.3 | 0% |
| CVE-2024-12164 | wpsyncsheets-wpforms (WordPress plugin) | The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data | medium | 4.3 | 0% |
| CVE-2020-36702 | spectra (WordPress plugin) | The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14 | medium | 5.5 | 0% |
| CVE-2021-4445 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. Thi | medium | 6.5 | 0% |
| CVE-2023-44401 | silverstripe/graphql | View permissions are bypassed for paginated lists of ORM data | medium | 5.3 | 0% |
| CVE-2026-48806 | twig/twig | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys | medium | 0.0 | 0% |
| CVE-2026-85990 | leantime/leantime | Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods | high | 8.8 | 0% |
| CVE-2025-59022 | typo3/cms-recycler | TYPO3 CMS Allows Broken Access Control in Recycler Module | high | 0.0 | 0% |
| CVE-2024-13654 | zoxpress (WordPress theme) | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a | high | 8.1 | 0% |
| CVE-2023-22488 | flarum/core | Flarum notifications can leak restricted content | medium | 6.8 | 0% |
| CVE-2026-76089 | verbb/formie | Formie: Missing authorization on sent notification resend modal exposes submission PII | high | 7.7 | 0% |
| CVE-2020-36840 | mp-timetable (WordPress plugin) | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check o | high | 7.3 | 0% |
| CVE-2026-64662 | statamic/cms | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries | medium | 6.5 | 0% |
| CVE-2024-13783 | formcraft (WordPress plugin) | The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in a | medium | 4.3 | 0% |
| CVE-2025-31686 | goalgorilla/open_social | Drupal Open Social Missing Authorization vulnerability | high | 8.1 | 0% |
| CVE-2019-25215 | ari-adminer (WordPress plugin) | The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the | high | 7.3 | 0% |
| CVE-2022-2276 | wp-edit-menu (WordPress plugin) | The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated att | medium | 4.3 | 0% |
| CVE-2025-5835 | droip (WordPress plugin) | The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_ | high | 8.8 | 0% |
| CVE-2026-44010 | craftcms/cms | Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure | high | 0.0 | 0% |
| CVE-2024-9829 | download-plugin (WordPress plugin) | The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handl | medium | 6.5 | 0% |
| CVE-2024-10078 | easy-post-types (WordPress plugin) | The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability | medium | 6.3 | 0% |
| CVE-2024-0237 | eventon (WordPress plugin) | The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing u | medium | 5.3 | 0% |
| CVE-2024-1798 | tutor-lms-migration-tool (WordPress plugin) | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tu | medium | 5.3 | 0% |
| CVE-2024-9583 | wp-rss-aggregator (WordPress plugin) | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functi | medium | 4.3 | 0% |
| CVE-2024-1123 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a miss | medium | 6.5 | 0% |
| CVE-2023-4025 | radio-player (WordPress plugin) | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_pla | medium | 5.3 | 0% |
| CVE-2023-4027 | radio-player (WordPress plugin) | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_set | medium | 5.3 | 0% |
| CVE-2024-12427 | multi-step-form (WordPress plugin) | The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_uploa | medium | 5.3 | 0% |
| CVE-2024-6824 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2024-9195 | whmcs-client-area (WordPress plugin) | The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalati | high | 8.8 | 0% |
| CVE-2026-76087 | verbb/formie | Formie: Unauthenticated users can overwrite incomplete submissions via submit action | high | 8.2 | 0% |
| CVE-2024-10717 | styler-for-ninja-forms-lite (WordPress plugin) | The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due | medium | 6.5 | 0% |
| CVE-2024-1044 | customer-reviews-for-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che | medium | 5.3 | 0% |
| CVE-2023-2557 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 4.3 | 0% |
| CVE-2023-2561 | gallery-metabox (WordPress plugin) | The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove | medium | 4.3 | 0% |
| CVE-2024-5685 | snipe/snipe-it | Snipe-IT allows users to promote or demote themselves or other users | high | 8.1 | 0% |
| CVE-2026-48808 | twig/twig | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` | medium | 0.0 | 0% |
| CVE-2024-1385 | wp-stateless (WordPress plugin) | The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | high | 7.1 | 0% |
| CVE-2024-4566 | woolentor-addons (WordPress plugin) | The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss | high | 7.1 | 0% |
| CVE-2023-6742 | envira-gallery-lite (WordPress plugin) | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an im | medium | 4.3 | 0% |
| CVE-2024-1686 | woo-thank-you-page-customizer (WordPress plugin) | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all ver | medium | 4.3 | 0% |
| CVE-2024-1771 | total (WordPress theme) | The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sectio | medium | 4.3 | 0% |
| CVE-2024-1870 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ca | medium | 4.3 | 0% |
| CVE-2023-5352 | awesome-support (WordPress plugin) | The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts fo | medium | 4.3 | 0% |