Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10897 | tutor-lms-elementor-addons (WordPress plugin) | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2025-11726 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including | medium | 4.3 | 0% |
| CVE-2026-28557 | wpforo (WordPress plugin) | wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reass | medium | 6.5 | 0% |
| CVE-2026-47233 | admidio/admidio | Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 | medium | 6.5 | 0% |
| CVE-2025-3437 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a mi | medium | 4.3 | 0% |
| CVE-2024-6392 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing c | medium | 5.4 | 0% |
| CVE-2024-13737 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 4.3 | 0% |
| CVE-2024-7721 | html5-video-player (WordPress plugin) | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a | medium | 4.3 | 0% |
| CVE-2024-10543 | tumult-hype-animations (WordPress plugin) | The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypean | medium | 4.3 | 0% |
| CVE-2024-1218 | kali-forms (WordPress plugin) | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modificat | medium | 4.3 | 0% |
| CVE-2024-13374 | wp-table-manager (WordPress plugin) | The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptm_getFolders AJAX | medium | 4.3 | 0% |
| CVE-2025-9954 | drupal/acquia_dam | This module enables you to connect a Drupal site to the Acquia DAM service, which syncs media from the third party servi | high | 7.5 | 0% |
| CVE-2025-4431 | featured-image-plus (WordPress plugin) | The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a m | medium | 4.3 | 0% |
| CVE-2025-4683 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due t | medium | 4.3 | 0% |
| CVE-2024-1217 | kali-forms (WordPress plugin) | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation | high | 7.6 | 0% |
| CVE-2024-12610 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2024-12620 | animategl (WordPress plugin) | The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to unauthorized modifica | medium | 5.3 | 0% |
| CVE-2025-1483 | ltl-freight-quotes (WordPress plugin) | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi | medium | 5.3 | 0% |
| CVE-2026-33759 | wwbn/avideo | AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents | medium | 5.3 | 0% |
| CVE-2025-4571 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due t | medium | 5.4 | 0% |
| CVE-2024-10606 | wp-travel-engine (WordPress plugin) | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data | medium | 4.3 | 0% |
| CVE-2024-1328 | newsletter2go (WordPress plugin) | The Newsletter2Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2025-2290 | lifterlms (WordPress plugin) | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a | medium | 5.3 | 0% |
| CVE-2025-10054 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-1668 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check | medium | 4.3 | 0% |
| CVE-2025-59017 | typo3/cms-backend, typo3/cms-beuser, typo3/cms-dashboard +2 more | TYPO3 backend modules have Broken Access Control | medium | 0.0 | 0% |
| CVE-2026-42137 | getkirby/cms | Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API | high | 0.0 | 0% |
| CVE-2021-24988 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboa | medium | 5.4 | 0% |
| CVE-2024-13769 | puzzles (WordPress plugin) | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to | medium | 6.4 | 0% |
| CVE-2024-5641 | one-click-order-reorder (WordPress plugin) | The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th | medium | 6.4 | 0% |
| CVE-2024-13652 | ecpay-ecommerce-for-woocommerce (WordPress plugin) | The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2024-13703 | crm-customer-relationship-management-by-vcita (WordPress plugin) | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che | medium | 4.3 | 0% |
| CVE-2025-1408 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-0939 | magicform (WordPress plugin) | The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX a | medium | 6.3 | 0% |
| CVE-2024-6489 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 5.3 | 0% |
| CVE-2024-12033 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() funct | medium | 4.3 | 0% |
| CVE-2025-3452 | secupress (WordPress plugin) | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2025-5282 | wp-travel-engine (WordPress plugin) | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a | high | 7.5 | 0% |
| CVE-2025-11564 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missin | medium | 5.3 | 0% |
| CVE-2026-32270 | craftcms/commerce | Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments | low | 0.0 | 0% |
| CVE-2020-15247 | october/cms | Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. | medium | 5.2 | 0% |
| CVE-2022-0444 | xcloner (WordPress plugin) | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF c | medium | 4.3 | 0% |
| CVE-2024-13526 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2020-26231 | october/cms | Bypass of fix for CVE-2020-15247, Twig sandbox escape | medium | 5.2 | 0% |
| CVE-2026-33162 | craftcms/cms | Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions | medium | 0.0 | 0% |
| CVE-2024-48898 | moodle/moodle | moodle: Some users can delete audiences of other reports | medium | 6.5 | 0% |
| CVE-2025-3780 | wc-frontend-manager (WordPress plugin) | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unaut | medium | 6.5 | 0% |
| CVE-2024-6155 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request For | medium | 6.4 | 0% |
| CVE-2024-6458 | wc-product-table-lite (WordPress plugin) | The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability ch | medium | 6.4 | 0% |
| CVE-2024-7888 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 6.3 | 0% |