Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1425 | wpqa-builder (WordPress plugin) | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message | medium | 4.3 | 1% |
| CVE-2022-1600 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes | medium | 5.3 | 1% |
| CVE-2021-24473 | user-profile-picture (WordPress plugin) | The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by de | medium | 5.4 | 1% |
| CVE-2021-37709 | shopware/core, shopware/platform | Insecure direct object reference of log files of the Import/Export feature | medium | 6.5 | 1% |
| CVE-2018-16704 | gleez/cms | Gleez CMS Vulnerability Allows Forced Browsing to Profile Page of Other Users | medium | 4.3 | 1% |
| CVE-2022-2877 | titan-anti-spam-\&-security (WordPress plugin) | The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP addres | medium | 5.3 | 1% |
| CVE-2022-2913 | login-no-captcha-recaptcha (WordPress plugin) | The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on t | medium | 4.3 | 1% |
| CVE-2025-3810 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. Th | critical | 9.8 | 1% |
| CVE-2025-3811 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. Th | critical | 9.8 | 1% |
| CVE-2022-2198 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displ | medium | 4.3 | 1% |
| CVE-2023-4213 | simplr-registration-form (WordPress plugin) | The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, | high | 8.8 | 1% |
| CVE-2023-38872 | gugoan/economizzer | Economizzer Insecure Direct Object Reference vulnerability | low | 3.7 | 1% |
| CVE-2024-8791 | charitable (WordPress plugin) | The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege esc | critical | 9.8 | 1% |
| CVE-2023-3063 | sp-client-document-manager (WordPress plugin) | The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, | high | 8.8 | 1% |
| CVE-2023-0688 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions | medium | 6.5 | 1% |
| CVE-2022-1613 | restricted-site-access (WordPress plugin) | The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR | medium | 5.3 | 1% |
| CVE-2023-2548 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. Thi | medium | 6.6 | 1% |
| CVE-2022-29434 | spiffy-calendar (WordPress plugin) | Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or | medium | 6.3 | 1% |
| CVE-2026-27591 | winter/wn-backend-module | Winter vulnerable to privilege escalation by authenticated backend users | critical | 9.9 | 1% |
| CVE-2026-47156 | mantisbt/mantisbt | MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator | critical | 0.0 | 1% |
| CVE-2024-10215 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to th | critical | 9.8 | 1% |
| CVE-2024-1075 | minimal-coming-soon-maintenance-mode (WordPress plugin) | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all v | low | 3.7 | 1% |
| CVE-2022-3794 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2 | medium | 5.4 | 1% |
| CVE-2026-68500 | sylius/mollie-plugin | Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook | high | 7.5 | 1% |
| CVE-2022-43492 | wpdiscuz (WordPress plugin) | Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress. | medium | 4.3 | 1% |
| CVE-2024-10174 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | high | 7.3 | 1% |
| CVE-2022-3282 | drag-and-drop-multiple-file-upload---contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, takin | medium | 4.3 | 1% |
| CVE-2023-0693 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in ve | medium | 6.5 | 1% |
| CVE-2023-0694 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, a | medium | 6.5 | 1% |
| CVE-2025-4796 | wp-event-solution (WordPress plugin) | The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. Th | high | 8.8 | 1% |
| CVE-2021-24800 | dw-question-\&-answer (WordPress plugin) | The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, | medium | 4.3 | 1% |
| CVE-2022-0442 | userswp (WordPress plugin) | The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for us | medium | 4.3 | 1% |
| CVE-2022-36284 | affiliate-for-woocommerce (WordPress plugin) | Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change th | medium | 6.4 | 1% |
| CVE-2023-0550 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. Th | high | 8.1 | 1% |
| CVE-2024-2472 | latepoint (WordPress plugin) | The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability | critical | 9.1 | 1% |
| CVE-2024-2543 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_u | medium | 4.3 | 1% |
| CVE-2024-0839 | feedwordpress (WordPress plugin) | The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due | medium | 5.3 | 1% |
| CVE-2023-7199 | relevanssi (WordPress plugin) | The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read dra | medium | 5.3 | 1% |
| CVE-2023-1889 | directorist (WordPress plugin) | The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is d | medium | 6.5 | 1% |
| CVE-2024-0421 | mappress-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX act | medium | 5.3 | 1% |
| CVE-2022-4097 | all-in-one-security (WordPress plugin) | The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security feat | medium | 5.3 | 1% |
| CVE-2022-3995 | woo-wallet (WordPress plugin) | The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due t | medium | 4.3 | 1% |
| CVE-2024-8292 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all ve | critical | 9.8 | 1% |
| CVE-2024-9862 | miniorange-firebase-sms-otp-verification (WordPress plugin) | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and in | critical | 9.8 | 1% |
| CVE-2024-8290 | wc-frontend-manager (WordPress plugin) | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insec | high | 8.8 | 1% |
| CVE-2023-5544 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-25983 | moodle/moodle | Authorization Bypass in moodle | medium | 5.3 | 1% |
| CVE-2026-68501 | sylius/mollie-plugin | Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII | medium | 6.5 | 1% |
| CVE-2023-0691 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in version | medium | 4.3 | 1% |
| CVE-2023-0692 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in ve | medium | 4.3 | 1% |