Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13715 | zstore-manager-basic (WordPress plugin) | The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstore_cle | medium | 4.3 | 0% |
| CVE-2024-13816 | aiomatic (WordPress plugin) | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unaut | medium | 5.4 | 0% |
| CVE-2024-13420 | april (WordPress plugin), auteur (WordPress plugin), benaa (WordPress plugin) +1 more | Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions | medium | 4.3 | 0% |
| CVE-2025-1326 | homey (WordPress theme) | The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_ | medium | 4.3 | 0% |
| CVE-2026-11607 | typo3/cms-core, typo3/cms-form | TYPO3 CMS has Broken Access Control in its Form Framework | high | 0.0 | 0% |
| CVE-2026-47343 | typo3/cms-core | TYPO3 CMS: Destructive Actions on File Mount Folders | high | 0.0 | 0% |
| CVE-2026-47349 | typo3/cms-core, typo3/cms-recycler | TYPO3 CMS has Broken Access Control in the Recycler Module | medium | 0.0 | 0% |
| CVE-2026-47350 | typo3/cms-core | TYPO3 CMS has Broken Access Control in its DataHandler | medium | 0.0 | 0% |
| CVE-2026-47351 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS: Broken Access Control in Media Module | medium | 0.0 | 0% |
| CVE-2026-47352 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS has Broken Access Control in Backend API | medium | 0.0 | 0% |
| CVE-2026-42174 | getkirby/cms | Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions | medium | 0.0 | 0% |
| CVE-2024-13775 | woocommerce-support-ticket-system (WordPress plugin) | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability c | medium | 5.4 | 0% |
| CVE-2026-48507 | snipe/snipe-it | Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users | high | 7.1 | 0% |
| CVE-2026-32818 | admidio/admidio | Admidio is Missing Authorization on Forum Topic and Post Deletion | medium | 6.5 | 0% |
| CVE-2024-5331 | breakdance (WordPress plugin) | The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it | medium | 4.3 | 0% |
| CVE-2023-4059 | profile-builder (WordPress plugin) | The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated us | medium | 4.3 | 0% |
| CVE-2025-8944 | oceanwp (WordPress plugin) | The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request hand | medium | 4.3 | 0% |
| CVE-2026-33177 | statamic/cms | Statamic is missing authorization check on taxonomy term creation via fieldtype | medium | 4.3 | 0% |
| CVE-2026-41232 | froxlor/froxlor | Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing | medium | 5.0 | 0% |
| CVE-2026-42069 | getkirby/cms | Kirby CMS's read access to site, user and role information is not gated by permissions | high | 0.0 | 0% |
| CVE-2026-21896 | getkirby/cms | Kirby is missing permission checks in the content changes API | medium | 0.0 | 0% |
| CVE-2026-26274 | october/october | October CMS has Safe Mode Bypass via Twig Database Write Operations | medium | 6.6 | 0% |
| CVE-2026-41235 | froxlor/froxlor | Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement | high | 8.8 | 0% |
| CVE-2025-62394 | moodle/moodle | Moodle sends quiz-related messages to inactive/suspended users | medium | 4.3 | 0% |
| CVE-2025-14457 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a m | low | 3.7 | 0% |
| CVE-2025-9294 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missi | medium | 4.3 | 0% |
| CVE-2026-7879 | concrete5/concrete5 | Concrete CMS has an unauthorized file access issue | medium | 0.0 | 0% |
| CVE-2024-0516 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability | medium | 5.3 | 0% |
| CVE-2026-47742 | shopper/framework | Shopper: Missing authorization on Product admin Livewire sub-form components | medium | 6.5 | 0% |
| CVE-2026-47745 | shopper/framework | Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables | medium | 6.5 | 0% |
| CVE-2024-44020 | wp-free-ssl (WordPress plugin) | Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issu | medium | 4.3 | 0% |
| CVE-2026-33161 | craftcms/cms | Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users | low | 0.0 | 0% |
| CVE-2026-46365 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags | medium | 5.4 | 0% |
| CVE-2024-11916 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due t | high | 7.4 | 0% |
| CVE-2026-35179 | wwbn/avideo | AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php | medium | 5.3 | 0% |
| CVE-2025-3527 | eventon (WordPress plugin) | The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib | medium | 6.4 | 0% |
| CVE-2026-53634 | code16/sharp | Sharp Missing Authorization Check in Quick Creation Command Endpoints | medium | 4.3 | 0% |
| CVE-2026-45009 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ | medium | 4.3 | 0% |
| CVE-2026-100855 | azuracast/azuracast | AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration | medium | 6.5 | 0% |
| CVE-2026-9808 | mautic/core | Mautic has an Authorization Bypass in API v2 Endpoints | high | 7.1 | 0% |
| CVE-2025-12022 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-12023 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-12085 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-12169 | wsdesk (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2026-8238 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR | medium | 0.0 | 0% |
| CVE-2024-13419 | april (WordPress plugin), auteur (WordPress plugin), benaa (WordPress plugin) +1 more | Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability | medium | 6.4 | 0% |
| CVE-2026-100854 | azuracast/azuracast | AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption | medium | 6.3 | 0% |
| CVE-2026-8239 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR | medium | 0.0 | 0% |
| CVE-2026-107850 | contao/core-bundle | Contao: Improper access control in the preview links module | medium | 4.3 | 0% |
| CVE-2026-107851 | contao/core-bundle | Contao: Improper access control in the table access voter | medium | 4.3 | 0% |