Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5386 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_d | medium | 6.5 | 0% |
| CVE-2024-29885 | silverstripe/reports | Silverstripe Reports are still accessible even when `canView()` returns false | medium | 4.3 | 0% |
| CVE-2024-7624 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. | high | 8.1 | 0% |
| CVE-2024-0619 | payflex-payment-gateway (WordPress plugin) | The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 5.3 | 0% |
| CVE-2024-4858 | testimonials-carousel-elementor (WordPress plugin) | The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.3 | 0% |
| CVE-2024-7447 | funnelforms-free (WordPress plugin) | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to un | medium | 5.3 | 0% |
| CVE-2024-5053 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized | medium | 4.2 | 0% |
| CVE-2023-3999 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX ca | medium | 6.3 | 0% |
| CVE-2024-10535 | video-wc-gallery (WordPress plugin) | The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2024-8199 | reviews-feed (WordPress plugin) | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2025-31694 | drupal/tfa | This module enables you to allow and/or require users to use a second authentication method in addition to password auth | high | 8.1 | 0% |
| CVE-2024-5071 | bookster (WordPress plugin) | The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulat | medium | 6.5 | 0% |
| CVE-2023-5506 | imagemapper (WordPress plugin) | The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area | medium | 5.4 | 0% |
| CVE-2024-0596 | awesome-support (WordPress plugin) | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing | medium | 5.3 | 0% |
| CVE-2023-5387 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2023-5415 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2023-5416 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_d | medium | 4.3 | 0% |
| CVE-2024-13370 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 6.5 | 0% |
| CVE-2024-5861 | wp-easy-pay (WordPress plugin) | The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability che | medium | 5.3 | 0% |
| CVE-2026-24749 | silverstripe/assets | Silverstripe Assets Module has a DBFile::getURL() permission bypass | medium | 5.3 | 0% |
| CVE-2023-7268 | artplacer-widget (WordPress plugin) | The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authentic | medium | 6.5 | 0% |
| CVE-2024-45689 | moodle/moodle | Moodle allows users to retrieve information they did not have permission to access | medium | 6.5 | 0% |
| CVE-2024-9697 | social-rocket (WordPress plugin) | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 5.3 | 0% |
| CVE-2026-33761 | wwbn/avideo | AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings | medium | 5.3 | 0% |
| CVE-2024-6455 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due | medium | 5.3 | 0% |
| CVE-2024-12614 | passwords-manager (WordPress plugin) | The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_ | high | 7.5 | 0% |
| CVE-2024-8432 | webba-booking-lite (WordPress plugin) | The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 4.3 | 0% |
| CVE-2023-6966 | the-moneytizer (WordPress plugin) | The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missin | high | 8.1 | 0% |
| CVE-2024-1639 | license-manager-for-woocommerce (WordPress plugin) | The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t | medium | 6.5 | 0% |
| CVE-2025-31685 | goalgorilla/open_social | Drupal Open Social Missing Authorization vulnerability | critical | 9.1 | 0% |
| CVE-2024-1175 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-13316 | scratch-win-giveaways-for-website-facebook (WordPress plugin) | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vu | medium | 5.3 | 0% |
| CVE-2024-9109 | flexible-shipping-ups (WordPress plugin) | The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a | medium | 4.3 | 0% |
| CVE-2024-7727 | html5-video-player (WordPress plugin) | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missin | medium | 5.3 | 0% |
| CVE-2023-5385 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_c | medium | 4.3 | 0% |
| CVE-2023-5411 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2023-5417 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_u | medium | 4.3 | 0% |
| CVE-2023-5419 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2024-1053 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th | medium | 4.3 | 0% |
| CVE-2026-80202 | kimai/kimai | Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation | medium | 0.0 | 0% |
| CVE-2024-12184 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check o | medium | 5.3 | 0% |
| CVE-2026-34369 | wwbn/avideo | AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification | medium | 5.3 | 0% |
| CVE-2025-49549 | magento/community-edition, magento/project-community-edition | Magento Authenticated Security feature bypass | low | 2.7 | 0% |
| CVE-2024-1340 | login-lockdown (WordPress plugin) | The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2026-48014 | shopware/core, shopware/platform | Shopware: Admin API ACL Bypass in Order State Transition Endpoints | medium | 6.5 | 0% |
| CVE-2026-56830 | shopper/framework | Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph) | medium | 6.5 | 0% |
| CVE-2024-0201 | product-expiry-for-woocommerce (WordPress plugin) | The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-9065 | wp-helper-lite (WordPress plugin) | The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whp_ | medium | 5.3 | 0% |
| CVE-2026-86431 | league/commonmark | league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed | high | 7.2 | 0% |
| CVE-2024-3627 | wheel-of-life (WordPress plugin) | The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of d | medium | 5.4 | 0% |