Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2379 | easy-student-results (WordPress plugin) | The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve info | high | 7.5 | 3% |
| CVE-2025-1562 | wp-marketing-automations (WordPress plugin) | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable | critical | 9.8 | 3% |
| CVE-2017-1002006 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecti | high | 7.5 | 3% |
| CVE-2017-1002007 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting | high | 7.5 | 3% |
| CVE-2020-11511 | learnpress (WordPress plugin) | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the a | high | 8.1 | 3% |
| CVE-2018-20147 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. | medium | 6.5 | 3% |
| CVE-2015-10143 | platform-theme (WordPress theme) | The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing c | critical | 9.8 | 3% |
| CVE-2021-24947 | responsive-vector-maps (WordPress plugin) | The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path par | medium | 6.5 | 3% |
| CVE-2017-6816 | WordPress core | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. | medium | 4.9 | 3% |
| CVE-2021-24997 | wp-guppy (WordPress plugin) | The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them a | medium | 6.5 | 3% |
| CVE-2025-2075 | uncanny-automator (WordPress plugin) | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation | high | 8.8 | 3% |
| CVE-2022-2846 | calendar-event-multi-view (WordPress plugin) | The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event | medium | 4.3 | 3% |
| CVE-2024-7135 | tainacan (WordPress plugin) | The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_file' function | medium | 6.5 | 3% |
| CVE-2021-24356 | simple-301-redirects (WordPress plugin) | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJ | high | 8.8 | 3% |
| CVE-2020-9457 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vuln | high | 8.8 | 3% |
| CVE-2020-9456 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privilege | high | 8.8 | 3% |
| CVE-2020-9458 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privilege | high | 8.8 | 3% |
| CVE-2024-0324 | profile-builder (WordPress plugin) | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | high | 8.2 | 2% |
| CVE-2019-9574 | hrm (WordPress plugin) | The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Ad | high | 7.5 | 2% |
| CVE-2024-2771 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege es | critical | 9.8 | 2% |
| CVE-2020-24401 | magento/community-edition, magento/project-community-edition | Magento 2 Community Edition Incorrect Authorization | medium | 6.5 | 2% |
| CVE-2022-34255 | magento/community-edition | Magento Improper Access Control vulnerability | high | 8.8 | 2% |
| CVE-2020-36730 | cmp (WordPress plugin) | The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv | high | 8.3 | 2% |
| CVE-2022-0594 | shareaholic (WordPress plugin) | The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one | medium | 5.3 | 2% |
| CVE-2023-3076 | mstore-api (WordPress plugin) | The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their w | critical | 9.8 | 2% |
| CVE-2025-1307 | newscrunch (WordPress theme) | The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_a | critical | 9.8 | 2% |
| CVE-2022-34256 | magento/community-edition | Magento Improper Authorization vulnerability | high | 7.5 | 2% |
| CVE-2024-9161 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data d | medium | 6.5 | 2% |
| CVE-2022-4939 | wc-multivendor-membership (WordPress plugin) | THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing cap | critical | 9.8 | 2% |
| CVE-2022-0633 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to | medium | 6.5 | 2% |
| CVE-2021-39321 | sassy-social-share (WordPress plugin) | Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJ | high | 8.8 | 2% |
| CVE-2023-0291 | quiz-master-next (WordPress plugin) | The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated | high | 7.2 | 2% |
| CVE-2017-6923 | drupal/core, drupal/drupal | Missing Authorization in Drupal | medium | 6.5 | 2% |
| CVE-2018-10092 | dolibarr/dolibarr | Dolibarr arbitrary commands execution | high | 8.0 | 2% |
| CVE-2021-36917 | hide-my-wp (WordPress plugin) | WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token whi | medium | 6.5 | 2% |
| CVE-2019-12498 | wp-live-chat-support (WordPress plugin) | The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check pr | critical | 9.8 | 2% |
| CVE-2022-31042 | guzzlehttp/guzzle, drupal/core | Failure to strip the Cookie header on change in host or HTTP downgrade | high | 7.5 | 2% |
| CVE-2022-2373 | simply-schedule-appointments (WordPress plugin) | The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users | medium | 5.3 | 2% |
| CVE-2020-12669 | dolibarr/dolibarr | Incorrect Authorization in Dolibarr | high | 8.8 | 2% |
| CVE-2020-6168 | minimal-coming-soon-maintenance-mode (WordPress plugin) | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable | high | 7.6 | 2% |
| CVE-2017-6377 | drupal/core, drupal/drupal | Drupal editor module incorrectly checks access to inline private files | high | 7.5 | 2% |
| CVE-2021-36909 | wp-reset-pro (WordPress plugin) | Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe | high | 8.8 | 2% |
| CVE-2021-4368 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This i | critical | 9.9 | 2% |
| CVE-2023-5311 | wp-extra (WordPress plugin) | The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() fun | high | 8.8 | 2% |
| CVE-2022-2376 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated a | medium | 5.3 | 2% |
| CVE-2024-12365 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_ | high | 8.5 | 2% |
| CVE-2020-12477 | nilsteampassnet/teampass | Incorrect Authorization in TeamPass | high | 7.5 | 2% |
| CVE-2021-36037 | magento/community-edition, magento/project-community-edition | Magento is affected by an improper authorization vulnerability | medium | 6.5 | 2% |
| CVE-2021-38299 | web-auth/webauthn-framework | Improper Access Control in Webauthn Framework | critical | 9.8 | 2% |
| CVE-2023-6036 | web3---crypto-wallet-login-\&-nft-token-gating (WordPress plugin) | The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow | critical | 9.8 | 2% |