Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3024 | simple-bitcoin-faucets (WordPress plugin) | The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authentic | medium | 5.4 | 0% |
| CVE-2025-11228 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 5.3 | 0% |
| CVE-2025-12877 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data du | medium | 5.3 | 0% |
| CVE-2024-48901 | moodle/moodle | moodle: IDOR when fetching report schedules | medium | 4.3 | 0% |
| CVE-2024-8632 | kb-support (WordPress plugin) | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data d | medium | 6.5 | 0% |
| CVE-2022-3451 | product-stock-manager (WordPress plugin) | The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowin | medium | 4.3 | 0% |
| CVE-2022-4124 | popup-manager (WordPress plugin) | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthe | medium | 4.3 | 0% |
| CVE-2026-34737 | wwbn/avideo | AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug | medium | 6.5 | 0% |
| CVE-2024-6750 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability | high | 7.3 | 0% |
| CVE-2023-6798 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unaut | medium | 5.4 | 0% |
| CVE-2026-44585 | paymenter/paymenter | Paymenter has broken object level authorization via service reference manipulation on ticket creation | medium | 5.4 | 0% |
| CVE-2025-2289 | zegen (WordPress theme) | The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJA | medium | 4.3 | 0% |
| CVE-2025-3863 | post-carousel-slider-for-elementor (WordPress plugin) | The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2025-3880 | social-polls-by-opinionstage (WordPress plugin) | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misco | medium | 4.3 | 0% |
| CVE-2024-34434 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Mi | medium | 6.5 | 0% |
| CVE-2026-53638 | sylius/sylius | Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint | medium | 4.3 | 0% |
| CVE-2024-10294 | ce21-suite (WordPress plugin) | The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single | medium | 6.5 | 0% |
| CVE-2024-7491 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versi | medium | 5.3 | 0% |
| CVE-2024-32792 | hummingbird (WordPress plugin) | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects | medium | 4.3 | 0% |
| CVE-2025-1507 | googleanalytics (WordPress plugin) | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi | medium | 5.3 | 0% |
| CVE-2022-4872 | chained-products (WordPress plugin) | The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option | medium | 4.3 | 0% |
| CVE-2026-55542 | snipe/snipe-it | Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL | low | 0.0 | 0% |
| CVE-2023-7288 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capabili | medium | 5.4 | 0% |
| CVE-2023-7289 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability | medium | 5.4 | 0% |
| CVE-2023-6491 | strong-testimonials (WordPress plugin) | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the w | medium | 4.3 | 0% |
| CVE-2023-7292 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized notification dismissal due to a missing cap | medium | 4.3 | 0% |
| CVE-2024-10614 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the canc | medium | 4.3 | 0% |
| CVE-2024-11911 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_ | medium | 4.3 | 0% |
| CVE-2024-12855 | adforest (WordPress theme) | The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX action | medium | 4.3 | 0% |
| CVE-2024-1376 | event-post (WordPress plugin) | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdat | medium | 4.3 | 0% |
| CVE-2024-1803 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 4.3 | 0% |
| CVE-2024-4088 | attire-blocks (WordPress plugin) | The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 0% |
| CVE-2024-4661 | wp-reset (WordPress plugin) | The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax func | medium | 4.3 | 0% |
| CVE-2024-5860 | tickera-event-ticketing-system (WordPress plugin) | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-6883 | event-espresso-decaf (WordPress plugin) | The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings m | medium | 4.3 | 0% |
| CVE-2024-8437 | wp-easy-gallery (WordPress plugin) | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2024-5607 | ninja-gdpr-compliance (WordPress plugin) | The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 5.4 | 0% |
| CVE-2026-40099 | getkirby/cms | Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter | medium | 0.0 | 0% |
| CVE-2024-12879 | wpot (WordPress plugin) | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2025-4522 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via | medium | 6.5 | 0% |
| CVE-2024-2544 | popup-builder (WordPress plugin) | The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check | high | 7.4 | 0% |
| CVE-2024-9628 | wps-telegram-chat (WordPress plugin) | The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability c | medium | 6.3 | 0% |
| CVE-2024-9630 | wps-telegram-chat (WordPress plugin) | The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages i | medium | 5.4 | 0% |
| CVE-2026-49288 | statamic/cms | Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources | medium | 4.3 | 0% |
| CVE-2026-50550 | snipe/snipe-it | Snipe-IT has a 2FA reset privilege bypass | medium | 5.8 | 0% |
| CVE-2026-28424 | statamic/cms | Statamic's missing authorization allows access to email addresses | medium | 6.5 | 0% |
| CVE-2023-5611 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its set | medium | 5.3 | 0% |
| CVE-2025-48013 | drupal/quick_node_block | This module provides a block to easily display a rendered node. Access to the rendered node isn't validated before rend | medium | 5.3 | 0% |
| CVE-2025-48444 | drupal/quick_node_block | This module provides a block to easily display a rendered node. The module doesn't check access to content before displ | medium | 5.3 | 0% |
| CVE-2024-10860 | nextmove (WordPress plugin) | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing ca | medium | 4.3 | 0% |