Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-0984 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-3961 | convertkit (WordPress plugin) | The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modific | medium | 5.3 | 0% |
| CVE-2024-1778 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 4.3 | 0% |
| CVE-2024-3609 | reviewx (WordPress plugin) | The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a m | medium | 4.3 | 0% |
| CVE-2023-3204 | materialis (WordPress theme) | The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due | medium | 6.5 | 0% |
| CVE-2023-2494 | go-pricing (WordPress plugin) | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missin | medium | 4.6 | 0% |
| CVE-2024-13447 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_bookin | medium | 4.3 | 0% |
| CVE-2025-1667 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on | high | 8.8 | 0% |
| CVE-2024-8552 | download-monitor (WordPress plugin) | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable | medium | 4.3 | 0% |
| CVE-2025-49550 | magento/community-edition, magento/project-community-edition | Magento Security feature bypass | medium | 4.3 | 0% |
| CVE-2025-4179 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() | high | 7.3 | 0% |
| CVE-2024-1687 | woo-thank-you-page-customizer (WordPress plugin) | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcod | medium | 5.4 | 0% |
| CVE-2026-48807 | twig/twig | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters | medium | 0.0 | 0% |
| CVE-2025-3645 | moodle/moodle | Moodle has an IDOR in messaging web service which allows access to some user details | medium | 4.3 | 0% |
| CVE-2025-2816 | page-views-count (WordPress plugin) | The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a mi | high | 8.1 | 0% |
| CVE-2024-1937 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'u | high | 7.1 | 0% |
| CVE-2024-5459 | food-and-drink-menu (WordPress plugin) | The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check | medium | 4.3 | 0% |
| CVE-2025-4177 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() func | medium | 5.3 | 0% |
| CVE-2022-2377 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated user | medium | 4.3 | 0% |
| CVE-2022-2382 | product-slider-for-woocommerce (WordPress plugin) | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-2389 | funnelkit-automations (WordPress plugin) | The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before | medium | 4.3 | 0% |
| CVE-2026-44176 | getkirby/cms | Kirby CMS's `pages.access` permission is not checked during rendering of page drafts | medium | 0.0 | 0% |
| CVE-2026-45334 | getkirby/cms | Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions | medium | 0.0 | 0% |
| CVE-2024-0452 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_ | medium | 5.0 | 0% |
| CVE-2024-0453 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_ | medium | 5.0 | 0% |
| CVE-2024-7429 | zotpress (WordPress plugin) | The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_proce | medium | 4.3 | 0% |
| CVE-2024-9364 | wp-sendgrid-mailer (WordPress plugin) | The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mail | medium | 4.3 | 0% |
| CVE-2026-41325 | getkirby/cms | Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection | high | 0.0 | 0% |
| CVE-2024-12821 | media-manager (WordPress plugin) | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation | high | 8.8 | 0% |
| CVE-2025-2103 | soundrise (WordPress plugin) | The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a m | high | 8.8 | 0% |
| CVE-2024-1042 | wp-radio (WordPress plugin) | The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to unauthorized modification of da | medium | 6.4 | 0% |
| CVE-2024-0828 | play-ht (WordPress plugin) | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to unauthorized access of functio | medium | 5.4 | 0% |
| CVE-2024-9587 | linkz-ai (WordPress plugin) | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' f | medium | 5.4 | 0% |
| CVE-2024-11852 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulner | medium | 4.3 | 0% |
| CVE-2024-3893 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a | medium | 4.3 | 0% |
| CVE-2024-5665 | easy-login-woocommerce (WordPress plugin) | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capa | medium | 4.3 | 0% |
| CVE-2024-6033 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due | medium | 4.3 | 0% |
| CVE-2026-32268 | craftcms/azure-blob | Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability | high | 0.0 | 0% |
| CVE-2026-49981 | twig/twig | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` | high | 0.0 | 0% |
| CVE-2024-12719 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_aj | medium | 4.3 | 0% |
| CVE-2024-1861 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |
| CVE-2024-8771 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | medium | 4.3 | 0% |
| CVE-2026-33160 | craftcms/cms | Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL | low | 0.0 | 0% |
| CVE-2024-8548 | kb-support (WordPress plugin) | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due | high | 8.1 | 0% |
| CVE-2024-9025 | sight (WordPress plugin) | The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-10326 | rometheme-for-elementor (WordPress plugin) | The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-13776 | zoomsounds (WordPress plugin) | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can | high | 8.1 | 0% |
| CVE-2023-7291 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capab | high | 7.1 | 0% |
| CVE-2024-1634 | calendar-booking (WordPress plugin) | The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabi | medium | 6.5 | 0% |
| CVE-2024-12104 | atarim-visual-collaboration (WordPress plugin) | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due | medium | 5.3 | 0% |