Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8548 | kb-support (WordPress plugin) | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due | high | 8.1 | 0% |
| CVE-2024-9025 | sight (WordPress plugin) | The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-10326 | rometheme-for-elementor (WordPress plugin) | The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-13776 | zoomsounds (WordPress plugin) | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can | high | 8.1 | 0% |
| CVE-2023-7291 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capab | high | 7.1 | 0% |
| CVE-2024-1634 | calendar-booking (WordPress plugin) | The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabi | medium | 6.5 | 0% |
| CVE-2024-12104 | atarim-visual-collaboration (WordPress plugin) | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due | medium | 5.3 | 0% |
| CVE-2026-56385 | craftcms/cms | Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata | low | 0.0 | 0% |
| CVE-2021-24836 | temporary-login-without-password (WordPress plugin) | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, w | medium | 4.3 | 0% |
| CVE-2024-0372 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of da | medium | 4.3 | 0% |
| CVE-2024-1078 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ays_quick_st | medium | 4.3 | 0% |
| CVE-2024-35720 | album-gallery (WordPress plugin) | Missing Authorization vulnerability in A WP Life Album Gallery – WordPress Gallery.This issue affects Album Gallery – WordPress Gallery: fro | medium | 4.3 | 0% |
| CVE-2024-5784 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on | high | 7.1 | 0% |
| CVE-2025-5956 | hrm (WordPress plugin) | The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the aja | medium | 6.5 | 0% |
| CVE-2025-14757 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including | medium | 5.3 | 0% |
| CVE-2023-6598 | speedycache (WordPress plugin) | The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache | medium | 4.3 | 0% |
| CVE-2019-25214 | wpshopify (WordPress plugin) | The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versio | high | 7.2 | 0% |
| CVE-2024-12336 | wc-affiliate (WordPress plugin) | The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missin | medium | 6.5 | 0% |
| CVE-2025-2267 | wp01 (WordPress plugin) | The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capabili | medium | 6.5 | 0% |
| CVE-2024-10853 | buy-one-click-woocommerce (WordPress plugin) | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-5654 | cf7-google-sheets-connector (WordPress plugin) | The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 6.5 | 0% |
| CVE-2024-6332 | ameliabooking (WordPress plugin) | The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of da | medium | 6.5 | 0% |
| CVE-2024-12713 | sureforms (WordPress plugin) | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, a | medium | 5.3 | 0% |
| CVE-2022-4024 | pie-register (WordPress plugin) | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, | medium | 6.5 | 0% |
| CVE-2024-5453 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2024-7622 | revision-manager-tmc (WordPress plugin) | The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2024-8434 | themehunk-megamenu-plus (WordPress plugin) | The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability ch | medium | 4.3 | 0% |
| CVE-2026-50282 | craftcms/cms | Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves | high | 0.0 | 0% |
| CVE-2024-7030 | clover-online-orders (WordPress plugin) | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 4.3 | 0% |
| CVE-2026-55483 | snipe/snipe-it | Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation | medium | 0.0 | 0% |
| CVE-2023-6007 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capabilit | high | 7.3 | 0% |
| CVE-2024-8369 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-prot | medium | 5.3 | 0% |
| CVE-2022-0164 | coming-soon-and-maintenance-mode (WordPress plugin) | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail | medium | 4.3 | 0% |
| CVE-2024-12331 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2026-47226 | admidio/admidio | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges | medium | 6.5 | 0% |
| CVE-2021-25025 | eventcalendar (WordPress plugin) | The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-0634 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privi | medium | 4.3 | 0% |
| CVE-2024-1090 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-1091 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-5770 | wp-force-ssl (WordPress plugin) | The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch | medium | 4.2 | 0% |
| CVE-2023-6504 | profile-builder (WordPress plugin) | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |
| CVE-2022-3946 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to | medium | 6.5 | 0% |
| CVE-2021-24730 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_d | medium | 4.3 | 0% |
| CVE-2022-0363 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, al | medium | 4.3 | 0% |
| CVE-2024-4445 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 6.5 | 0% |
| CVE-2026-48500 | filament/filament | Filament: Unauthenticated temporary file upload on auth pages | medium | 6.5 | 0% |
| CVE-2024-0893 | schema-app-structured-data-for-schemaorg (WordPress plugin) | The Schema App Structured Data plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-11844 | ideapush (WordPress plugin) | The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the idea_push_taxo | medium | 4.3 | 0% |
| CVE-2024-12596 | lifterlms (WordPress plugin) | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missi | medium | 4.3 | 0% |
| CVE-2024-1955 | wp-hide-backed-notices (WordPress plugin) | The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o | medium | 4.3 | 0% |