Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-30885 | wwbn/avideo | AVideo has Unauthenticated IDOR - Playlist Information Disclosure | medium | 0.0 | 0% |
| CVE-2026-50284 | craftcms/cms | Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets | high | 0.0 | 0% |
| CVE-2024-5941 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to | medium | 5.4 | 0% |
| CVE-2024-1779 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2023-1928 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_prel | medium | 4.3 | 0% |
| CVE-2023-1929 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_purg | medium | 4.3 | 0% |
| CVE-2023-1930 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the wpfc_clear_ca | medium | 4.3 | 0% |
| CVE-2023-1931 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the deleteCssAndJsCac | medium | 4.3 | 0% |
| CVE-2023-2174 | badgeos (WordPress plugin) | The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_ | medium | 4.3 | 0% |
| CVE-2023-2284 | wp-security-audit-log (WordPress plugin) | The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2023-4948 | woocommerce-cvr-payment-gateway (WordPress plugin) | The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2023-6066 | wp-custom-widget-area (WordPress plugin) | The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callb | medium | 4.3 | 0% |
| CVE-2024-6621 | wp-rss-aggregator (WordPress plugin) | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2026-14793 | craftcms/cms | Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets | medium | 4.3 | 0% |
| CVE-2026-49205 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) | medium | 6.5 | 0% |
| CVE-2023-6876 | clever-fox (WordPress plugin) | The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a | medium | 5.4 | 0% |
| CVE-2024-4468 | salon-booking-system (WordPress plugin) | The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2024-6012 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2026-14794 | craftcms/cms | Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics | medium | 4.3 | 0% |
| CVE-2026-48492 | snipe/snipe-it | Snipe-IT's selectlist visibility is too permissive | medium | 0.0 | 0% |
| CVE-2026-35671 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: IDOR Account Takeover | high | 8.8 | 0% |
| CVE-2024-3942 | masterstudy-lms (WordPress plugin) | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modificat | medium | 6.3 | 0% |
| CVE-2022-3538 | webmaster-tools-verification (WordPress plugin) | The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing u | medium | 6.5 | 0% |
| CVE-2024-0451 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_c | medium | 5.0 | 0% |
| CVE-2023-7068 | print-invoices-packing-slip-labels-for-woocommerce (WordPress plugin) | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of | medium | 4.3 | 0% |
| CVE-2021-25097 | labtools (WordPress plugin) | The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing an | medium | 6.5 | 0% |
| CVE-2021-24790 | contact-form-advanced-database (WordPress plugin) | The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_d | medium | 4.3 | 0% |
| CVE-2025-31678 | drupal/ai | The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes. The module | high | 8.2 | 0% |
| CVE-2024-3600 | poll-maker (WordPress plugin) | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability ch | high | 7.2 | 0% |
| CVE-2026-88974 | wp-graphql/wp-graphql | WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost | medium | 5.4 | 0% |
| CVE-2022-3489 | wp-hide (WordPress plugin) | The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settin | medium | 5.3 | 0% |
| CVE-2024-1041 | wp-radio (WordPress plugin) | The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-12201 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when cr | medium | 4.3 | 0% |
| CVE-2024-5703 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | medium | 4.3 | 0% |
| CVE-2024-6491 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2025-2876 | melapress-login-security (WordPress plugin) | The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a | medium | 5.3 | 0% |
| CVE-2024-2619 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insu | medium | 5.0 | 0% |
| CVE-2024-10854 | buy-one-click-woocommerce (WordPress plugin) | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2025-11996 | find-unused-images (WordPress plugin) | The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_i | medium | 5.3 | 0% |
| CVE-2024-10537 | wp-user-manager (WordPress plugin) | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing c | medium | 4.3 | 0% |
| CVE-2024-11583 | borderless (WordPress plugin) | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss | medium | 4.3 | 0% |
| CVE-2024-1860 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unautho | medium | 6.5 | 0% |
| CVE-2023-6731 | wp-show-posts (WordPress plugin) | The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX funct | medium | 4.3 | 0% |
| CVE-2024-1133 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due | medium | 4.3 | 0% |
| CVE-2024-11936 | zox-news (WordPress theme) | The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing c | high | 8.8 | 0% |
| CVE-2024-12129 | royal-core (WordPress plugin) | The Royal Core plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missin | high | 8.8 | 0% |
| CVE-2024-0238 | eventon (WordPress plugin) | The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and do | medium | 6.1 | 0% |
| CVE-2025-1766 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data | medium | 5.3 | 0% |
| CVE-2025-2789 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for Word | medium | 5.3 | 0% |
| CVE-2024-0983 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |