Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.3, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2011-5270 | WordPress core | wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticat | medium | 4.0 | 1% |
| CVE-2017-18584 | post-pay-counter (WordPress plugin) | The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action. | high | 7.5 | 1% |
| CVE-2016-10929 | advanced-ajax-page-loader (WordPress plugin) | The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in. | medium | 5.3 | 1% |
| CVE-2022-34149 | wp-oauth-server (WordPress plugin) | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. | critical | 9.8 | 1% |
| CVE-2022-33969 | flipbox (WordPress plugin) | Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress. | high | 7.2 | 1% |
| CVE-2022-36375 | responsive-tabs (WordPress plugin) | Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress. | high | 7.2 | 1% |
| CVE-2022-38104 | accordions-or-faqs (WordPress plugin) | Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari | high | 7.2 | 1% |
| CVE-2007-1893 | WordPress core | xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended | medium | 4.9 | 1% |
| CVE-2022-33970 | shortcode-addons (WordPress plugin) | Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress. | high | 7.2 | 1% |
| CVE-2022-34868 | yookassa (WordPress plugin) | Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. | high | 8.8 | 1% |
| CVE-2022-29423 | countdown-builder (WordPress plugin) | Pro Features Lock Bypass vulnerability in Countdown & Clock plugin <= 2.3.2 at WordPress. | low | 3.8 | 1% |
| CVE-2022-38134 | customer-reviews-woocommerce (WordPress plugin) | Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. | medium | 4.3 | 1% |
| CVE-2022-36387 | about-me (WordPress plugin) | Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress. | high | 7.6 | 1% |
| CVE-2022-38070 | pop-up-pop-up (WordPress plugin) | Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress. | medium | 5.4 | 1% |
| CVE-2022-37344 | accommodation-system (WordPress plugin) | Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress. | high | 7.6 | 1% |
| CVE-2022-36425 | beaver-builder-lite-version (WordPress plugin) | Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress. | medium | 5.4 | 1% |
| CVE-2022-36793 | wp-shop-original (WordPress plugin) | Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress. | medium | 6.5 | 1% |
| CVE-2022-27235 | social-share-buttons-by-supsystic (WordPress plugin) | Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. | medium | 6.3 | 1% |
| CVE-2022-25649 | affiliate-for-woocommerce (WordPress plugin) | Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress. | medium | 5.0 | 1% |
| CVE-2022-36427 | about-rentals (WordPress plugin) | Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress. | high | 7.3 | 1% |
| CVE-2022-42459 | image-hover-effects-ultimate (WordPress plugin) | Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress. | high | 7.2 | 1% |
| CVE-2022-45069 | crowdsignal-dashboard (WordPress plugin) | Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress. | medium | 6.3 | 1% |
| CVE-2022-41781 | permalink-manager-lite (WordPress plugin) | Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress. | medium | 6.5 | 1% |
| CVE-2022-35238 | awesome-filterable-portfolio (WordPress plugin) | Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress. | medium | 6.5 | 1% |
| CVE-2022-42461 | google-authenticator (WordPress plugin) | Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress. | medium | 5.4 | 1% |
| CVE-2022-45066 | wooswipe-woocommerce-gallery (WordPress plugin) | Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress. | medium | 5.4 | 1% |
| CVE-2022-38067 | calendar-event (WordPress plugin) | Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress. | medium | 6.5 | 1% |
| CVE-2022-38135 | photospace (WordPress plugin) | Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher | medium | 5.4 | 1% |
| CVE-2022-38058 | wp-shamsi (WordPress plugin) | Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress. | medium | 4.3 | 1% |
| CVE-2022-38461 | wpml (WordPress plugin) | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher | medium | 5.4 | 1% |
| CVE-2022-38974 | wpml (WordPress plugin) | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher us | medium | 4.3 | 1% |
| CVE-2022-45369 | plugin-for-google-reviews (WordPress plugin) | Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress. | medium | 4.3 | 1% |
| CVE-2022-41839 | loginpress (WordPress plugin) | Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tr | medium | 5.3 | 1% |
| CVE-2022-42460 | traffic-manager (WordPress plugin) | Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress. | medium | 6.5 | 0% |
| CVE-2022-41132 | ezoic (WordPress plugin) | Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. | medium | 6.1 | 0% |