Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9861 | miniorange-firebase-sms-otp-verification (WordPress plugin) | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, | high | 8.1 | 1% |
| CVE-2021-32709 | shopware/platform, shopware/core | Creation of order credits was not validated by acl in admin orders | low | 4.9 | 1% |
| CVE-2024-7503 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is | critical | 9.8 | 1% |
| CVE-2026-56346 | wwbn/avideo | AVideo has Unauthenticated PGP Message Decryption via Public Endpoint | medium | 0.0 | 1% |
| CVE-2022-38057 | th-advance-product-search (WordPress plugin) | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/ | medium | 6.5 | 1% |
| CVE-2026-27012 | devcode-it/openstamanager | OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php | critical | 9.8 | 1% |
| CVE-2025-1717 | login-me-now (WordPress plugin) | The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecur | high | 8.1 | 1% |
| CVE-2024-9289 | affiliate-pro (WordPress plugin) | The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and includi | critical | 9.8 | 1% |
| CVE-2024-10002 | rover-idx (WordPress plugin) | The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insuf | high | 8.8 | 1% |
| CVE-2024-13553 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versi | critical | 9.8 | 1% |
| CVE-2026-33038 | wwbn/avideo | AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments | high | 8.1 | 1% |
| CVE-2025-1315 | injob (WordPress plugin) | The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. T | critical | 9.8 | 1% |
| CVE-2023-25013 | in2code/femanager | Broken Access Control in 3rd party TYPO3 extension "femanager" | high | 8.6 | 1% |
| CVE-2023-25014 | in2code/femanager | Broken Access Control in 3rd party TYPO3 extension "femanager" | high | 8.6 | 1% |
| CVE-2026-34731 | wwbn/avideo | AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php | high | 7.5 | 0% |
| CVE-2024-9522 | wp-users-masquerade (WordPress plugin) | The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to | high | 8.8 | 0% |
| CVE-2026-45754 | symfony/lox24-notifier, symfony/mailjet-mailer, symfony/symfony | Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection | medium | 0.0 | 0% |
| CVE-2024-13771 | civi (WordPress plugin) | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up | critical | 9.8 | 0% |
| CVE-2026-39393 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass | high | 8.1 | 0% |
| CVE-2024-1076 | ssl-zen (WordPress plugin) | The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the | medium | 6.5 | 0% |
| CVE-2024-10284 | ce21-suite (WordPress plugin) | The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded | critical | 9.8 | 0% |
| CVE-2026-25878 | frosh/adminer-platform | FroshAdminer Adminer UI is accessible without admin session | medium | 0.0 | 0% |
| CVE-2024-6635 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is | high | 7.3 | 0% |
| CVE-2026-30885 | wwbn/avideo | AVideo has Unauthenticated IDOR - Playlist Information Disclosure | medium | 0.0 | 0% |
| CVE-2026-34732 | wwbn/avideo | AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints | medium | 5.3 | 0% |
| CVE-2026-35450 | wwbn/avideo | AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php | medium | 5.3 | 0% |
| CVE-2024-9658 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions u | high | 8.8 | 0% |
| CVE-2026-33719 | wwbn/avideo | AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment | high | 8.6 | 0% |
| CVE-2026-104181 | filament/filament | Filament: Multi-factor authentication (app) management actions do not require password reauthentication | medium | 5.4 | 0% |
| CVE-2026-43881 | wwbn/avideo | AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restricti | medium | 5.3 | 0% |
| CVE-2026-33159 | craftcms/cms | Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations | medium | 0.0 | 0% |
| CVE-2024-13772 | civi (WordPress plugin) | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up | medium | 5.6 | 0% |
| CVE-2022-25770 | mautic/core, mautic/core-lib | Mautic has insufficient authentication in upgrade flow | high | 7.8 | 0% |
| CVE-2026-45755 | symfony/mailtrap-mailer, symfony/symfony | Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection | medium | 0.0 | 0% |
| CVE-2026-1900 | link-whisper (WordPress plugin) | The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates. | medium | 6.5 | 0% |
| CVE-2026-45610 | wwbn/avideo | AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA | medium | 5.7 | 0% |