Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-56384 | craftcms/cms | Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission | medium | 0.0 | 0% |
| CVE-2024-11601 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Vide | high | 8.1 | 0% |
| CVE-2024-6799 | yith-essential-kit-for-woocommerce-1 (WordPress plugin) | The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2025-3644 | moodle/moodle | Moodle's AJAX section delete does not respect course_can_delete_section() | medium | 4.3 | 0% |
| CVE-2025-8068 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an impro | medium | 4.3 | 0% |
| CVE-2025-48446 | drupal/commerce_alphabank_redirect | This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't | high | 8.8 | 0% |
| CVE-2024-4222 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing cap | high | 7.3 | 0% |
| CVE-2025-1481 | shortcode-cleaner-lite (WordPress plugin) | The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downlo | medium | 6.5 | 0% |
| CVE-2026-34395 | wwbn/avideo | AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php | medium | 6.5 | 0% |
| CVE-2024-13439 | tlp-team (WordPress plugin) | The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the r | medium | 4.3 | 0% |
| CVE-2025-1504 | post-lockdown (WordPress plugin) | The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocom | medium | 4.3 | 0% |
| CVE-2024-11724 | gdpr-cookie-consent (WordPress plugin) | The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is | medium | 4.3 | 0% |
| CVE-2024-13541 | adirectory (WordPress plugin) | The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabil | medium | 4.3 | 0% |
| CVE-2024-13361 | gpt3-ai-content-generator (WordPress plugin) | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_sav | medium | 6.3 | 0% |
| CVE-2024-12370 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding r | medium | 5.3 | 0% |
| CVE-2024-43433 | moodle/moodle | Moodle's user/power level management inconsistent with suspended users | medium | 5.3 | 0% |
| CVE-2024-5545 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-8658 | mycred (WordPress plugin) | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, an | medium | 5.3 | 0% |
| CVE-2024-8678 | revolut-gateway-for-woocommerce (WordPress plugin) | The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 5.3 | 0% |
| CVE-2024-12113 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 4.3 | 0% |
| CVE-2025-3915 | aeropage-sync-for-airtable (WordPress plugin) | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aer | medium | 4.3 | 0% |
| CVE-2025-10352 | melisplatform/melis-core | Melis Platform CMS Unauthenticated Admin Account Creation | critical | 0.0 | 0% |
| CVE-2025-26526 | moodle/moodle | Moodle's feedback response viewing and deletions did not respect Separate Groups mode | medium | 6.5 | 0% |
| CVE-2026-47227 | admidio/admidio | Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php | medium | 6.5 | 0% |
| CVE-2024-3268 | youtube-showcase (WordPress plugin) | The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modifi | medium | 5.3 | 0% |
| CVE-2024-9686 | order-notification-for-telegram (WordPress plugin) | The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability chec | medium | 5.3 | 0% |
| CVE-2024-13698 | jobify (WordPress theme) | The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capabili | medium | 6.5 | 0% |
| CVE-2024-6872 | templatespare (WordPress plugin) | The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenber | medium | 4.3 | 0% |
| CVE-2026-55479 | snipe/snipe-it | Snipe-IT has incorrect permission for legacy license checkin API | medium | 0.0 | 0% |
| CVE-2024-1125 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capa | medium | 5.4 | 0% |
| CVE-2025-3647 | moodle/moodle | Moodle allows IDOR when accessing the cohorts report | medium | 4.3 | 0% |
| CVE-2024-8121 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a miss | medium | 5.4 | 0% |
| CVE-2024-1804 | tutor-lms-migration-tool (WordPress plugin) | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-32818 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data an | medium | 4.3 | 0% |
| CVE-2024-6709 | sync-post-with-other-site (WordPress plugin) | The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-6836 | funnel-builder (WordPress plugin) | The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells | medium | 4.3 | 0% |
| CVE-2024-8427 | frontend-post-submission-manager-lite (WordPress plugin) | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modificatio | medium | 4.3 | 0% |
| CVE-2024-9067 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 4.3 | 0% |
| CVE-2024-9361 | bulk-image-resizer (WordPress plugin) | The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of da | medium | 4.3 | 0% |
| CVE-2024-9685 | notification-for-telegram (WordPress plugin) | The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2026-41657 | admidio/admidio | Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php | medium | 4.9 | 0% |
| CVE-2023-7019 | wp-maintenance-mode (WordPress plugin) | The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of d | medium | 4.3 | 0% |
| CVE-2026-33685 | wwbn/avideo | AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data | medium | 5.3 | 0% |
| CVE-2023-6883 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple A | medium | 4.3 | 0% |
| CVE-2024-1124 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing cap | medium | 4.3 | 0% |
| CVE-2024-13716 | fx-calculators (WordPress plugin) | The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_ | medium | 4.3 | 0% |
| CVE-2024-2298 | affiliate-toolkit-starter (WordPress plugin) | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability che | medium | 4.3 | 0% |
| CVE-2026-25633 | statamic/cms | Statamic CMS's missing authorization allows access to assets | medium | 4.3 | 0% |
| CVE-2024-10520 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'che | medium | 5.3 | 0% |
| CVE-2025-32045 | moodle/moodle | Moodle shows hidden grades to users without permission on some grade reports | medium | 5.3 | 0% |