Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3602 | promolayer-popup-builder (WordPress plugin) | The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2024-3711 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the f | medium | 4.3 | 0% |
| CVE-2024-4788 | boostify-header-footer-builder (WordPress plugin) | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2024-5449 | wp-dark-mode (WordPress plugin) | The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is | medium | 4.3 | 0% |
| CVE-2024-6987 | orchid-store (WordPress plugin) | The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_sto | medium | 4.3 | 0% |
| CVE-2024-9531 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-11133 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_ | medium | 5.3 | 0% |
| CVE-2026-55703 | snipe/snipe-it | Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET | medium | 4.3 | 0% |
| CVE-2026-64664 | statamic/cms | Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence | medium | 4.3 | 0% |
| CVE-2024-12810 | jobcareer (WordPress theme) | The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of dat | high | 8.8 | 0% |
| CVE-2024-11496 | infility-global (WordPress plugin) | The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infilit | medium | 6.5 | 0% |
| CVE-2024-13368 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 4.3 | 0% |
| CVE-2024-1400 | mollie-forms (WordPress plugin) | The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability check on the duplic | medium | 4.3 | 0% |
| CVE-2024-4205 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2023-4627 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() f | medium | 4.3 | 0% |
| CVE-2023-7067 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 4.3 | 0% |
| CVE-2024-1337 | skt-templates (WordPress plugin) | The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveS | medium | 4.3 | 0% |
| CVE-2024-1388 | yuki (WordPress theme) | The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_op | medium | 4.3 | 0% |
| CVE-2024-1649 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-1650 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-1652 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-1653 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2025-1325 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing | medium | 6.3 | 0% |
| CVE-2024-9520 | userplus (WordPress plugin) | The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on | medium | 6.3 | 0% |
| CVE-2026-56826 | shopper/framework | Shopping privilege escalation through missing authorization in Settings components | medium | 5.4 | 0% |
| CVE-2026-44012 | craftcms/cms | Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure | high | 0.0 | 0% |
| CVE-2026-32817 | admidio/admidio | Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion | critical | 9.1 | 0% |
| CVE-2023-7294 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capabili | high | 7.1 | 0% |
| CVE-2024-7381 | cf-geoplugin (WordPress plugin) | The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks | medium | 5.3 | 0% |
| CVE-2024-7390 | wp-testimonial-widget (WordPress plugin) | The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the f | medium | 5.3 | 0% |
| CVE-2025-0935 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on sev | medium | 4.3 | 0% |
| CVE-2026-55476 | snipe/snipe-it | Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter | medium | 0.0 | 0% |
| CVE-2024-13639 | expand-maker (WordPress plugin) | The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check | medium | 4.3 | 0% |
| CVE-2024-1689 | woo-tools (WordPress plugin) | The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooco | medium | 4.3 | 0% |
| CVE-2026-43885 | wwbn/avideo | AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization | high | 0.0 | 0% |
| CVE-2024-12611 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in | medium | 5.3 | 0% |
| CVE-2024-10582 | music-player-for-elementor (WordPress plugin) | The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due t | medium | 4.3 | 0% |
| CVE-2024-13693 | enfold (WordPress theme) | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in al | medium | 5.3 | 0% |
| CVE-2024-4450 | ali2woo-lite (WordPress plugin) | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on | medium | 6.3 | 0% |
| CVE-2024-7858 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functio | medium | 6.3 | 0% |
| CVE-2024-13449 | boom-fest (WordPress plugin) | The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bf_admin_act | medium | 4.3 | 0% |
| CVE-2026-56384 | craftcms/cms | Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission | medium | 0.0 | 0% |
| CVE-2024-11601 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Vide | high | 8.1 | 0% |
| CVE-2024-6799 | yith-essential-kit-for-woocommerce-1 (WordPress plugin) | The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2024-4222 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing cap | high | 7.3 | 0% |
| CVE-2025-1481 | shortcode-cleaner-lite (WordPress plugin) | The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downlo | medium | 6.5 | 0% |
| CVE-2026-34395 | wwbn/avideo | AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php | medium | 6.5 | 0% |
| CVE-2024-13439 | tlp-team (WordPress plugin) | The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the r | medium | 4.3 | 0% |
| CVE-2025-1504 | post-lockdown (WordPress plugin) | The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocom | medium | 4.3 | 0% |
| CVE-2024-11724 | gdpr-cookie-consent (WordPress plugin) | The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is | medium | 4.3 | 0% |