Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1328 | newsletter2go (WordPress plugin) | The Newsletter2Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2025-2290 | lifterlms (WordPress plugin) | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a | medium | 5.3 | 0% |
| CVE-2025-10054 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-1668 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check | medium | 4.3 | 0% |
| CVE-2026-46362 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check | medium | 6.5 | 0% |
| CVE-2026-54244 | statamic/cms | Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors | low | 3.5 | 0% |
| CVE-2025-59017 | typo3/cms-backend, typo3/cms-beuser, typo3/cms-dashboard +2 more | TYPO3 backend modules have Broken Access Control | medium | 0.0 | 0% |
| CVE-2026-42137 | getkirby/cms | Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API | high | 0.0 | 0% |
| CVE-2021-24988 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboa | medium | 5.4 | 0% |
| CVE-2024-47780 | typo3/cms-backend | Information Disclosure in TYPO3 Page Tree | low | 3.1 | 0% |
| CVE-2025-47937 | typo3/cms-core | TYPO3 Allows Information Disclosure via DBAL Restriction Handling | low | 3.7 | 0% |
| CVE-2026-8350 | concrete5/concrete5 | Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php | high | 0.0 | 0% |
| CVE-2026-47230 | admidio/admidio | Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders | medium | 6.5 | 0% |
| CVE-2024-13769 | puzzles (WordPress plugin) | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to | medium | 6.4 | 0% |
| CVE-2024-5641 | one-click-order-reorder (WordPress plugin) | The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th | medium | 6.4 | 0% |
| CVE-2024-13652 | ecpay-ecommerce-for-woocommerce (WordPress plugin) | The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2024-13703 | crm-customer-relationship-management-by-vcita (WordPress plugin) | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che | medium | 4.3 | 0% |
| CVE-2025-1408 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-0939 | magicform (WordPress plugin) | The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX a | medium | 6.3 | 0% |
| CVE-2024-6489 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 5.3 | 0% |
| CVE-2025-26531 | moodle/moodle | Moodle has an IDOR in badges allows disabling of arbitrary badges | low | 3.1 | 0% |
| CVE-2026-55643 | snipe/snipe-it | Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode | high | 0.0 | 0% |
| CVE-2026-41660 | admidio/admidio | Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP | high | 7.1 | 0% |
| CVE-2024-12033 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() funct | medium | 4.3 | 0% |
| CVE-2025-3452 | secupress (WordPress plugin) | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2025-5282 | wp-travel-engine (WordPress plugin) | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a | high | 7.5 | 0% |
| CVE-2025-11564 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missin | medium | 5.3 | 0% |
| CVE-2026-32270 | craftcms/commerce | Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments | low | 0.0 | 0% |
| CVE-2020-15247 | october/cms | Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. | medium | 5.2 | 0% |
| CVE-2022-0444 | xcloner (WordPress plugin) | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF c | medium | 4.3 | 0% |
| CVE-2024-13526 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2020-26231 | october/cms | Bypass of fix for CVE-2020-15247, Twig sandbox escape | medium | 5.2 | 0% |
| CVE-2026-33162 | craftcms/cms | Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions | medium | 0.0 | 0% |
| CVE-2024-48897 | moodle/moodle | moodle: IDOR in edit/delete RSS feed | medium | 6.5 | 0% |
| CVE-2024-48898 | moodle/moodle | moodle: Some users can delete audiences of other reports | medium | 6.5 | 0% |
| CVE-2025-3780 | wc-frontend-manager (WordPress plugin) | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unaut | medium | 6.5 | 0% |
| CVE-2024-6155 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request For | medium | 6.4 | 0% |
| CVE-2024-6458 | wc-product-table-lite (WordPress plugin) | The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability ch | medium | 6.4 | 0% |
| CVE-2024-7888 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 6.3 | 0% |
| CVE-2024-5309 | form-vibes (WordPress plugin) | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due t | medium | 5.4 | 0% |
| CVE-2025-4370 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_u | medium | 5.3 | 0% |
| CVE-2025-2104 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insuf | medium | 4.3 | 0% |
| CVE-2024-1809 | wp-analytify (WordPress plugin) | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access | medium | 5.4 | 0% |
| CVE-2025-4520 | uncanny-automator (WordPress plugin) | The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple | medium | 5.4 | 0% |
| CVE-2024-13651 | unusedcss (WordPress plugin) | The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c | medium | 4.3 | 0% |
| CVE-2026-42610 | getgrav/grav | Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass | medium | 6.5 | 0% |
| CVE-2023-6748 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 v | medium | 4.3 | 0% |
| CVE-2024-7836 | themify-builder (WordPress plugin) | The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify | medium | 4.3 | 0% |
| CVE-2022-25768 | mautic/core, mautic/core-lib | Mautic vulnerable to Improper Access Control in UI upgrade process | high | 7.0 | 0% |
| CVE-2024-1851 | affiliate-toolkit-starter (WordPress plugin) | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability che | medium | 6.3 | 0% |