Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-6954 | buddypress/buddypress | BuddyPress Docs plugin Improper Privilege Management | medium | 4.3 | 1% |
| CVE-2018-0573 | baserproject/basercms | baserCMS Access Control Bypass | medium | 5.3 | 1% |
| CVE-2020-7916 | learnpress (WordPress plugin) | be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself | medium | 6.5 | 1% |
| CVE-2018-1134 | moodle/moodle | Moodle Improper Privilege Management | medium | 6.5 | 1% |
| CVE-2017-15055 | nilsteampassnet/teampass | TeamPass Improper Privilege Management | high | 8.1 | 1% |
| CVE-2022-0579 | snipe/snipe-it | Improper Privilege Management in Snipe-IT | medium | 6.5 | 1% |
| CVE-2019-3849 | moodle/moodle | Moodle Users could elevate their role when accessing the LTI tool on a provider site | high | 8.8 | 1% |
| CVE-2021-37627 | contao/contao, contao/core-bundle | Privilege escalation via form generator | high | 8.0 | 1% |
| CVE-2023-4293 | wpdm-premium-packages (WordPress plugin) | The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and incl | high | 8.8 | 1% |
| CVE-2021-22966 | concrete5/core | Improper Privilege Management in Concrete CMS | high | 8.8 | 1% |
| CVE-2017-7532 | moodle/moodle | Moodle Improper Privilege Management | medium | 6.5 | 1% |
| CVE-2017-15052 | nilsteampassnet/teampass | TeamPass Improper Privilege Management | medium | 4.9 | 1% |
| CVE-2017-15053 | nilsteampassnet/teampass | TeamPass Improper Privilege Management | medium | 4.9 | 1% |
| CVE-2023-4404 | charitable (WordPress plugin) | The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due t | critical | 9.8 | 1% |
| CVE-2022-42459 | image-hover-effects-ultimate (WordPress plugin) | Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress. | high | 7.2 | 1% |
| CVE-2015-9390 | admin-management-xtended (WordPress plugin) | The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled. | medium | 4.3 | 1% |
| CVE-2023-1762 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable privilege escalation from improper privilege management | high | 8.8 | 1% |
| CVE-2022-48365 | ezsystems/ezplatform-kernel, ezsystems/ezpublish-kernel | Company admin role gives excessive privileges in eZ Platform Ibexa | high | 7.2 | 1% |
| CVE-2023-3636 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficien | high | 8.8 | 1% |
| CVE-2024-57602 | alextselegidis/easyappointments | Easy!Appointments Improper Restriction of Excessive Authentication Attempts | critical | 9.8 | 1% |
| CVE-2024-41637 | billz/raspap-webgui | RaspAP allows an attacker to escalate privileges | critical | 9.9 | 1% |
| CVE-2023-4140 | wp-ultimate-csv-importer (WordPress plugin) | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insuf | medium | 6.6 | 1% |
| CVE-2024-6411 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, an | high | 8.8 | 1% |
| CVE-2024-1505 | academy (WordPress plugin) | The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versi | high | 8.8 | 1% |
| CVE-2022-42888 | armember (WordPress plugin) | Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress. | critical | 9.8 | 1% |
| CVE-2023-4239 | real-estate-manager (WordPress plugin) | The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient | high | 8.8 | 1% |
| CVE-2019-25151 | cartflows (WordPress plugin) | The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin funct | medium | 5.4 | 1% |
| CVE-2023-2240 | microweber/microweber | Improper Privilege Management in microweber | high | 8.8 | 1% |
| CVE-2021-24207 | wp-page-builder (WordPress plugin) | By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pa | medium | 4.3 | 1% |
| CVE-2025-2798 | woffice (WordPress theme) | The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a mi | critical | 9.8 | 1% |
| CVE-2024-32003 | winter/wn-dusk-plugin | Dusk plugin may allow unfettered user authentication in misconfigured installs | high | 8.8 | 1% |
| CVE-2021-45729 | gmap-embed (WordPress plugin) | The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role us | medium | 5.4 | 1% |
| CVE-2024-8853 | webo-facto-connector (WordPress plugin) | The Webo-facto plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.40 due to insufficient restric | critical | 9.8 | 1% |
| CVE-2026-38529 | krayin/laravel-crm | Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php | high | 8.8 | 1% |
| CVE-2024-9265 | echo-rss-feed-post-generator (WordPress plugin) | The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. Thi | critical | 9.8 | 1% |
| CVE-2024-9941 | wordpress-gym-management-system (WordPress plugin) | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on | high | 8.8 | 1% |
| CVE-2023-5549 | moodle/moodle | Moodle Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2024-21622 | craftcms/cms | Craft CMS Privilege Escalation | medium | 5.4 | 1% |
| CVE-2024-7493 | wpcom-member (WordPress plugin) | The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to th | critical | 9.8 | 1% |
| CVE-2024-11721 | acf-frontend-form-element (WordPress plugin) | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. Th | high | 8.1 | 1% |
| CVE-2025-2232 | realteo (WordPress plugin) | The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all | critical | 9.8 | 1% |
| CVE-2024-8420 | dhvc-form (WordPress plugin) | The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plu | critical | 9.8 | 1% |
| CVE-2026-55843 | snipe/snipe-it | Snipe-IT has an Improper Privilege Management issue | medium | 6.5 | 1% |
| CVE-2025-4315 | cubewp-framework (WordPress plugin) | The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl | high | 8.8 | 1% |
| CVE-2022-35921 | fof/byobu | Byobu user preference to prevent private discussions being started are not respected | low | 3.5 | 1% |
| CVE-2024-9518 | userplus (WordPress plugin) | The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to insufficient restrictio | critical | 9.8 | 1% |
| CVE-2024-4390 | depicter (WordPress plugin) | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and inclu | medium | 6.5 | 1% |
| CVE-2026-75837 | getgrav/grav | Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin | critical | 9.1 | 0% |
| CVE-2024-6482 | login-with-phone-number (WordPress plugin) | The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is | high | 8.8 | 0% |
| CVE-2024-8247 | newsletters-lite (WordPress plugin) | The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the | high | 8.8 | 0% |