Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-9574 | hrm (WordPress plugin) | The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Ad | high | 7.5 | 2% |
| CVE-2024-2771 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege es | critical | 9.8 | 2% |
| CVE-2020-36730 | cmp (WordPress plugin) | The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv | high | 8.3 | 2% |
| CVE-2023-3076 | mstore-api (WordPress plugin) | The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their w | critical | 9.8 | 2% |
| CVE-2025-1307 | newscrunch (WordPress theme) | The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_a | critical | 9.8 | 2% |
| CVE-2024-9161 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data d | medium | 6.5 | 2% |
| CVE-2022-4939 | wc-multivendor-membership (WordPress plugin) | THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing cap | critical | 9.8 | 2% |
| CVE-2023-0291 | quiz-master-next (WordPress plugin) | The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated | high | 7.2 | 2% |
| CVE-2017-6923 | drupal/core, drupal/drupal | Missing Authorization in Drupal | medium | 6.5 | 2% |
| CVE-2018-10092 | dolibarr/dolibarr | Dolibarr arbitrary commands execution | high | 8.0 | 2% |
| CVE-2021-36917 | hide-my-wp (WordPress plugin) | WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token whi | medium | 6.5 | 2% |
| CVE-2019-12498 | wp-live-chat-support (WordPress plugin) | The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check pr | critical | 9.8 | 2% |
| CVE-2022-2373 | simply-schedule-appointments (WordPress plugin) | The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users | medium | 5.3 | 2% |
| CVE-2020-6168 | minimal-coming-soon-maintenance-mode (WordPress plugin) | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable | high | 7.6 | 2% |
| CVE-2021-36909 | wp-reset-pro (WordPress plugin) | Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe | high | 8.8 | 2% |
| CVE-2021-4368 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This i | critical | 9.9 | 2% |
| CVE-2023-5311 | wp-extra (WordPress plugin) | The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() fun | high | 8.8 | 2% |
| CVE-2022-2376 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated a | medium | 5.3 | 2% |
| CVE-2024-12365 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_ | high | 8.5 | 2% |
| CVE-2019-16738 | mediawiki/core | MediaWiki information disclosure | medium | 5.3 | 2% |
| CVE-2026-24421 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) | medium | 6.5 | 2% |
| CVE-2019-14793 | meta-box (WordPress plugin) | The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file atta | medium | 6.5 | 2% |
| CVE-2018-25019 | learndash (WordPress plugin) | The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_a | high | 7.5 | 2% |
| CVE-2010-1617 | moodle/moodle | Moodle doesn't properly check role | low | 0.0 | 2% |
| CVE-2021-4356 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, | critical | 9.0 | 2% |
| CVE-2021-25002 | tipsacarrier (WordPress plugin) | The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenti | high | 7.5 | 2% |
| CVE-2021-25087 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unaut | high | 7.5 | 2% |
| CVE-2024-5324 | login\/signup-popup (WordPress plugin), otp-login-woocommerce-\&-gravity-forms (WordPress plugin), side-cart-woocommerce (WordPress plugin) +1 more | Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capabilit | high | 8.8 | 2% |
| CVE-2021-24977 | use-any-font (WordPress plugin) | The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing | medium | 6.1 | 1% |
| CVE-2021-24906 | protect-wp-admin (WordPress plugin) | The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow un | high | 7.5 | 1% |
| CVE-2021-24354 | simple-301-redirects (WordPress plugin) | A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin befo | high | 8.8 | 1% |
| CVE-2023-6700 | wp-gdpr-compliance (WordPress plugin) | The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capabili | high | 8.8 | 1% |
| CVE-2021-24163 | ninja-forms (WordPress plugin) | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protect | high | 8.8 | 1% |
| CVE-2021-24184 | tutor-lms (WordPress plugin) | Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing stud | high | 8.8 | 1% |
| CVE-2020-9455 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary ema | medium | 4.3 | 1% |
| CVE-2021-4362 | kiwi-social-share (WordPress plugin) | The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_ | critical | 9.8 | 1% |
| CVE-2021-4343 | ulisting (WordPress plugin) | The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including | critical | 9.8 | 1% |
| CVE-2021-4370 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated user | critical | 9.8 | 1% |
| CVE-2021-4381 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing securit | critical | 9.8 | 1% |
| CVE-2021-4448 | kaswara (WordPress plugin) | The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insuf | high | 7.3 | 1% |
| CVE-2019-14786 | seo (WordPress plugin) | The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb paramet | medium | 6.5 | 1% |
| CVE-2022-4950 | cool-timeline (WordPress plugin), cryptocurrency-payment-\&-donation-box (WordPress plugin), cryptocurrency-widgets (WordPress plugin) +7 more | Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote c | high | 8.8 | 1% |
| CVE-2021-25075 | duplicate-page-or-post (WordPress plugin) | The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplica | low | 3.5 | 1% |
| CVE-2023-6985 | ai-assistant-by-10web (WordPress plugin) | The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 6.5 | 1% |
| CVE-2014-6292 | in2code/femanager | TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users | medium | 0.0 | 1% |
| CVE-2020-25629 | moodle/moodle | Moodle incorrect access control | high | 8.8 | 1% |
| CVE-2019-25142 | materialis (WordPress plugin), mesmerize (WordPress plugin) | The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesm | high | 8.8 | 1% |
| CVE-2025-1361 | ip2location-country-blocker (WordPress plugin) | The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.3 | high | 7.5 | 1% |
| CVE-2024-0679 | colormag (WordPress theme) | The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() func | medium | 6.5 | 1% |
| CVE-2021-4337 | add-product-tabs (WordPress plugin), autopilot-seo (WordPress plugin), bulk-add-to-cart (WordPress plugin) +13 more | Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax | high | 8.8 | 1% |