Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-11844 | ideapush (WordPress plugin) | The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the idea_push_taxo | medium | 4.3 | 0% |
| CVE-2024-12596 | lifterlms (WordPress plugin) | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missi | medium | 4.3 | 0% |
| CVE-2024-1955 | wp-hide-backed-notices (WordPress plugin) | The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2024-3602 | promolayer-popup-builder (WordPress plugin) | The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2024-3711 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the f | medium | 4.3 | 0% |
| CVE-2024-4788 | boostify-header-footer-builder (WordPress plugin) | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2024-5449 | wp-dark-mode (WordPress plugin) | The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is | medium | 4.3 | 0% |
| CVE-2024-6987 | orchid-store (WordPress plugin) | The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_sto | medium | 4.3 | 0% |
| CVE-2024-9531 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-11133 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_ | medium | 5.3 | 0% |
| CVE-2026-55462 | snipe/snipe-it | Snipe-IT has an authorization bypass on print inventory page | medium | 4.3 | 0% |
| CVE-2026-55703 | snipe/snipe-it | Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET | medium | 4.3 | 0% |
| CVE-2026-64664 | statamic/cms | Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence | medium | 4.3 | 0% |
| CVE-2024-12810 | jobcareer (WordPress theme) | The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of dat | high | 8.8 | 0% |
| CVE-2024-11496 | infility-global (WordPress plugin) | The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infilit | medium | 6.5 | 0% |
| CVE-2023-49783 | silverstripe/admin | No permission checks for editing/deleting records with CSV import form | medium | 4.3 | 0% |
| CVE-2024-13368 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 4.3 | 0% |
| CVE-2024-1400 | mollie-forms (WordPress plugin) | The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability check on the duplic | medium | 4.3 | 0% |
| CVE-2024-4205 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2023-4627 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() f | medium | 4.3 | 0% |
| CVE-2023-7067 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 4.3 | 0% |
| CVE-2024-1337 | skt-templates (WordPress plugin) | The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveS | medium | 4.3 | 0% |
| CVE-2024-1388 | yuki (WordPress theme) | The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_op | medium | 4.3 | 0% |
| CVE-2024-1649 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-1650 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-1652 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-1653 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2025-1325 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing | medium | 6.3 | 0% |
| CVE-2024-9520 | userplus (WordPress plugin) | The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on | medium | 6.3 | 0% |
| CVE-2026-56826 | shopper/framework | Shopping privilege escalation through missing authorization in Settings components | medium | 5.4 | 0% |
| CVE-2026-46366 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query | high | 7.5 | 0% |
| CVE-2026-44012 | craftcms/cms | Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure | high | 0.0 | 0% |
| CVE-2026-32817 | admidio/admidio | Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion | critical | 9.1 | 0% |
| CVE-2023-7294 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capabili | high | 7.1 | 0% |
| CVE-2024-7381 | cf-geoplugin (WordPress plugin) | The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks | medium | 5.3 | 0% |
| CVE-2024-7390 | wp-testimonial-widget (WordPress plugin) | The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the f | medium | 5.3 | 0% |
| CVE-2025-0935 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on sev | medium | 4.3 | 0% |
| CVE-2026-55476 | snipe/snipe-it | Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter | medium | 0.0 | 0% |
| CVE-2024-13639 | expand-maker (WordPress plugin) | The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check | medium | 4.3 | 0% |
| CVE-2024-1689 | woo-tools (WordPress plugin) | The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooco | medium | 4.3 | 0% |
| CVE-2026-43885 | wwbn/avideo | AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization | high | 0.0 | 0% |
| CVE-2024-12611 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in | medium | 5.3 | 0% |
| CVE-2024-10582 | music-player-for-elementor (WordPress plugin) | The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due t | medium | 4.3 | 0% |
| CVE-2024-13693 | enfold (WordPress theme) | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in al | medium | 5.3 | 0% |
| CVE-2026-34364 | wwbn/avideo | AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php | medium | 5.3 | 0% |
| CVE-2024-4450 | ali2woo-lite (WordPress plugin) | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on | medium | 6.3 | 0% |
| CVE-2024-7858 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functio | medium | 6.3 | 0% |
| CVE-2024-13449 | boom-fest (WordPress plugin) | The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bf_admin_act | medium | 4.3 | 0% |
| CVE-2026-55472 | snipe/snipe-it | Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation | medium | 4.3 | 0% |
| CVE-2026-46635 | twig/twig | Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) | low | 0.0 | 0% |