Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-56385 | craftcms/cms | Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata | low | 0.0 | 0% |
| CVE-2026-57994 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ public FAQ APIs expose inactive FAQ content | medium | 5.3 | 0% |
| CVE-2021-24836 | temporary-login-without-password (WordPress plugin) | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, w | medium | 4.3 | 0% |
| CVE-2022-3880 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have pr | medium | 6.5 | 0% |
| CVE-2024-0372 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of da | medium | 4.3 | 0% |
| CVE-2024-1078 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ays_quick_st | medium | 4.3 | 0% |
| CVE-2024-35720 | album-gallery (WordPress plugin) | Missing Authorization vulnerability in A WP Life Album Gallery – WordPress Gallery.This issue affects Album Gallery – WordPress Gallery: fro | medium | 4.3 | 0% |
| CVE-2024-9654 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack | low | 3.7 | 0% |
| CVE-2024-5784 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on | high | 7.1 | 0% |
| CVE-2025-5956 | hrm (WordPress plugin) | The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the aja | medium | 6.5 | 0% |
| CVE-2026-71478 | league/commonmark | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes | medium | 6.1 | 0% |
| CVE-2025-14757 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including | medium | 5.3 | 0% |
| CVE-2023-6598 | speedycache (WordPress plugin) | The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache | medium | 4.3 | 0% |
| CVE-2019-25214 | wpshopify (WordPress plugin) | The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versio | high | 7.2 | 0% |
| CVE-2024-12336 | wc-affiliate (WordPress plugin) | The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missin | medium | 6.5 | 0% |
| CVE-2025-2267 | wp01 (WordPress plugin) | The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capabili | medium | 6.5 | 0% |
| CVE-2024-10853 | buy-one-click-woocommerce (WordPress plugin) | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2022-3879 | car-dealer (WordPress plugin) | The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in a | medium | 6.5 | 0% |
| CVE-2024-5654 | cf7-google-sheets-connector (WordPress plugin) | The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 6.5 | 0% |
| CVE-2024-6332 | ameliabooking (WordPress plugin) | The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of da | medium | 6.5 | 0% |
| CVE-2024-12713 | sureforms (WordPress plugin) | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, a | medium | 5.3 | 0% |
| CVE-2022-4024 | pie-register (WordPress plugin) | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, | medium | 6.5 | 0% |
| CVE-2024-5453 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2024-7622 | revision-manager-tmc (WordPress plugin) | The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2024-8434 | themehunk-megamenu-plus (WordPress plugin) | The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability ch | medium | 4.3 | 0% |
| CVE-2026-50282 | craftcms/cms | Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves | high | 0.0 | 0% |
| CVE-2026-42843 | getgrav/grav-plugin-api | Grav API Privilege Escalation to Super Admin | high | 8.8 | 0% |
| CVE-2026-47231 | admidio/admidio | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders | high | 8.1 | 0% |
| CVE-2024-7030 | clover-online-orders (WordPress plugin) | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 4.3 | 0% |
| CVE-2026-55483 | snipe/snipe-it | Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation | medium | 0.0 | 0% |
| CVE-2023-6007 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capabilit | high | 7.3 | 0% |
| CVE-2024-8369 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-prot | medium | 5.3 | 0% |
| CVE-2022-0164 | coming-soon-and-maintenance-mode (WordPress plugin) | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail | medium | 4.3 | 0% |
| CVE-2024-12331 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2026-47226 | admidio/admidio | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges | medium | 6.5 | 0% |
| CVE-2021-25025 | eventcalendar (WordPress plugin) | The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-0634 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privi | medium | 4.3 | 0% |
| CVE-2024-1090 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-1091 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-5770 | wp-force-ssl (WordPress plugin) | The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch | medium | 4.2 | 0% |
| CVE-2023-6504 | profile-builder (WordPress plugin) | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |
| CVE-2022-3946 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to | medium | 6.5 | 0% |
| CVE-2026-55475 | snipe/snipe-it | Snipe-IT's import created_by can be overwritten | medium | 5.7 | 0% |
| CVE-2021-24730 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_d | medium | 4.3 | 0% |
| CVE-2022-0363 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, al | medium | 4.3 | 0% |
| CVE-2022-3882 | wp-memory (WordPress plugin) | The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authoris | medium | 6.5 | 0% |
| CVE-2022-3883 | stopbadbots (WordPress plugin) | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authori | medium | 6.5 | 0% |
| CVE-2024-4445 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 6.5 | 0% |
| CVE-2026-48500 | filament/filament | Filament: Unauthenticated temporary file upload on auth pages | medium | 6.5 | 0% |
| CVE-2024-0893 | schema-app-structured-data-for-schemaorg (WordPress plugin) | The Schema App Structured Data plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |