Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2405 | wp-popup-builder (WordPress plugin) | The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated | medium | 4.3 | 0% |
| CVE-2022-2657 | multivendor-marketplace-solution-for-woocommerce---wc-marketplace (WordPress plugin) | The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actio | medium | 4.3 | 0% |
| CVE-2025-48445 | drupal/commerce_eurobank_redirect | This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't | high | 8.8 | 0% |
| CVE-2026-35448 | wwbn/avideo | AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php | low | 3.7 | 0% |
| CVE-2024-5382 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthor | medium | 6.5 | 0% |
| CVE-2024-5674 | newsletter (WordPress plugin) | The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issu | medium | 6.5 | 0% |
| CVE-2024-6755 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on | medium | 6.5 | 0% |
| CVE-2026-45703 | pimcore/pimcore | Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export | medium | 6.4 | 0% |
| CVE-2024-6590 | wpgsi (WordPress plugin) | The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as | medium | 6.3 | 0% |
| CVE-2023-7287 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing | medium | 5.4 | 0% |
| CVE-2024-2017 | countdown-builder (WordPress plugin) | The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capab | medium | 5.4 | 0% |
| CVE-2024-9584 | image-map-pro (WordPress plugin) | The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-5857 | funnelforms-free (WordPress plugin) | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to un | medium | 5.3 | 0% |
| CVE-2025-31673 | drupal/core | Bulk operations allow authorized users to modify several nodes at once from the Content page (`/admin/content`). A site | medium | 4.6 | 0% |
| CVE-2023-4728 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publish_lp() fu | medium | 4.3 | 0% |
| CVE-2024-11134 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_booki | medium | 4.3 | 0% |
| CVE-2026-44832 | snipe/snipe-it | Snipe-IT has Privilege Escalation via API Permissions Assignment | high | 8.8 | 0% |
| CVE-2025-30741 | pixelfed/pixelfed | Pixelfed may allow unauthorized actor to view private posts and private users | medium | 4.3 | 0% |
| CVE-2026-33159 | craftcms/cms | Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations | medium | 0.0 | 0% |
| CVE-2022-0398 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affili | medium | 5.4 | 0% |
| CVE-2024-13520 | gift-vouchers (WordPress plugin) | The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data| | medium | 5.3 | 0% |
| CVE-2020-15248 | october/backend | Privilege escalation by backend users assigned to the default "Publisher" system role | medium | 4.0 | 0% |
| CVE-2024-6869 | falang (WordPress plugin) | The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.4 | 0% |
| CVE-2024-13554 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 5.3 | 0% |
| CVE-2024-10897 | tutor-lms-elementor-addons (WordPress plugin) | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2025-11726 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including | medium | 4.3 | 0% |
| CVE-2025-59020 | typo3/cms-backend | TYPO3 CMS Allows Broken Access Control in Edit Document Controller | medium | 0.0 | 0% |
| CVE-2026-28557 | wpforo (WordPress plugin) | wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reass | medium | 6.5 | 0% |
| CVE-2026-47233 | admidio/admidio | Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 | medium | 6.5 | 0% |
| CVE-2025-3437 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a mi | medium | 4.3 | 0% |
| CVE-2024-6392 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing c | medium | 5.4 | 0% |
| CVE-2024-13737 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 4.3 | 0% |
| CVE-2024-7721 | html5-video-player (WordPress plugin) | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a | medium | 4.3 | 0% |
| CVE-2024-10543 | tumult-hype-animations (WordPress plugin) | The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypean | medium | 4.3 | 0% |
| CVE-2024-1218 | kali-forms (WordPress plugin) | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modificat | medium | 4.3 | 0% |
| CVE-2024-13374 | wp-table-manager (WordPress plugin) | The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptm_getFolders AJAX | medium | 4.3 | 0% |
| CVE-2025-12082 | drupal/civictheme | CivicTheme is a design system and theme framework used to build content-rich Drupal websites. It includes editorial work | high | 7.5 | 0% |
| CVE-2025-9954 | drupal/acquia_dam | This module enables you to connect a Drupal site to the Acquia DAM service, which syncs media from the third party servi | high | 7.5 | 0% |
| CVE-2025-4431 | featured-image-plus (WordPress plugin) | The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a m | medium | 4.3 | 0% |
| CVE-2025-4683 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due t | medium | 4.3 | 0% |
| CVE-2024-1217 | kali-forms (WordPress plugin) | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation | high | 7.6 | 0% |
| CVE-2026-48493 | snipe/snipe-it | Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment | medium | 5.5 | 0% |
| CVE-2025-67856 | moodle/moodle | Moodle has an authorization logic flaw | medium | 5.4 | 0% |
| CVE-2024-12610 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2024-12620 | animategl (WordPress plugin) | The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to unauthorized modifica | medium | 5.3 | 0% |
| CVE-2025-1483 | ltl-freight-quotes (WordPress plugin) | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi | medium | 5.3 | 0% |
| CVE-2026-33759 | wwbn/avideo | AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents | medium | 5.3 | 0% |
| CVE-2025-4101 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a mi | medium | 4.3 | 0% |
| CVE-2025-4571 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due t | medium | 5.4 | 0% |
| CVE-2024-10606 | wp-travel-engine (WordPress plugin) | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data | medium | 4.3 | 0% |