Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10860 | nextmove (WordPress plugin) | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2024-13358 | wc4bp (WordPress plugin) | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access | medium | 4.3 | 0% |
| CVE-2025-1780 | wc4bp (WordPress plugin) | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access | medium | 4.3 | 0% |
| CVE-2025-59021 | typo3/cms-redirects | TYPO3 CMS Allows Broken Access Control in Redirects Module | medium | 0.0 | 0% |
| CVE-2025-9637 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of | medium | 6.5 | 0% |
| CVE-2026-72785 | craftcms/cms | Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element | medium | 0.0 | 0% |
| CVE-2022-4103 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not | medium | 4.3 | 0% |
| CVE-2024-12825 | custom-related-posts (WordPress plugin) | The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-5987 | wp-accessibility-helper (WordPress plugin) | The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-6754 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_aut | medium | 5.4 | 0% |
| CVE-2026-41233 | froxlor/froxlor | Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() | medium | 5.4 | 0% |
| CVE-2024-6631 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 5.0 | 0% |
| CVE-2024-4427 | comparison-slider (WordPress plugin) | The Comparison Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several A | medium | 4.3 | 0% |
| CVE-2024-7380 | cf-geoplugin (WordPress plugin) | The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__g | medium | 4.3 | 0% |
| CVE-2026-80197 | kimai/kimai | Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation | low | 0.0 | 0% |
| CVE-2024-47055 | mautic/core | Mautic segment cloning doesn't have a proper permission check | medium | 4.3 | 0% |
| CVE-2025-26532 | moodle/moodle | Moodle allows teachers to evade trusttext config when restoring glossary entries | low | 3.1 | 0% |
| CVE-2021-21264 | october/cms | Bypass of fix for CVE-2020-26231, Twig sandbox escape | medium | 5.2 | 0% |
| CVE-2022-4148 | oauth-server (WordPress plugin) | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, w | medium | 4.3 | 0% |
| CVE-2024-13687 | team-display (WordPress plugin) | The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2026-45007 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Auth | medium | 4.3 | 0% |
| CVE-2026-42071 | mantisbt/mantisbt | MantisBT has a Private Bugnote Attachment Content Leak via REST API | high | 0.0 | 0% |
| CVE-2021-4446 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to m | medium | 6.3 | 0% |
| CVE-2025-12782 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2025-13354 | taxopress (WordPress plugin) | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versio | medium | 4.3 | 0% |
| CVE-2026-47740 | shopper/framework | shopper/framework: Authorization bypass in multiple Livewire admin components | high | 8.1 | 0% |
| CVE-2025-5813 | import-products-to-wc (WordPress plugin) | The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2025-12469 | wp-marketing-automations (WordPress plugin) | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Aut | medium | 4.3 | 0% |
| CVE-2026-42070 | mantisbt/mantisbt | MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API | medium | 0.0 | 0% |
| CVE-2026-34245 | wwbn/avideo | AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking | medium | 6.3 | 0% |
| CVE-2022-4102 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not | low | 3.1 | 0% |
| CVE-2026-47346 | typo3/cms-core, typo3/cms-form | TYPO3 CMS has Broken Access Control in its Form Framework | high | 0.0 | 0% |
| CVE-2025-5692 | wp-leads-builder-any-crm (WordPress plugin) | The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several | medium | 6.3 | 0% |
| CVE-2024-4422 | comparison-slider (WordPress plugin) | The Comparison Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider title parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2023-7290 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2023-7293 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2025-67737 | azuracast/azuracast | AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE | low | 3.1 | 0% |
| CVE-2023-6029 | eazydocs (WordPress plugin) | The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they | high | 7.5 | 0% |
| CVE-2025-67559 | online-booking-\&-scheduling-calendar (WordPress plugin) | Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows E | medium | 5.4 | 0% |
| CVE-2025-13828 | mautic/core | Mautic user without privileged access to the Marketplace can install and uninstall composer packages | critical | 0.0 | 0% |
| CVE-2026-41128 | craftcms/cms | Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action | medium | 0.0 | 0% |
| CVE-2026-34247 | wwbn/avideo | AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notificat | medium | 5.4 | 0% |
| CVE-2023-1414 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow a | medium | 4.3 | 0% |
| CVE-2026-41498 | kimai/kimai | Kimai has Missing Object-Level Authorization in the Team API | low | 3.3 | 0% |
| CVE-2026-31887 | shopware/core, shopware/platform | Shopware: Unauthenticated data extraction possible through store-api.order endpoint | high | 0.0 | 0% |
| CVE-2026-33684 | wwbn/avideo | AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions | medium | 5.3 | 0% |
| CVE-2026-33650 | wwbn/avideo | AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion | high | 7.6 | 0% |
| CVE-2024-13335 | sastra-essential-addons-for-elementor (WordPress plugin) | The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due | medium | 4.3 | 0% |
| CVE-2026-49741 | typo3/cms-core, typo3/cms-form | TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework | high | 0.0 | 0% |
| CVE-2026-41658 | admidio/admidio | Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items | medium | 6.5 | 0% |