Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-43664 | prestashop/prestashop | PrestaShop allows employee without any access rights to list all installed modules | medium | 4.3 | 0% |
| CVE-2026-25497 | craftcms/cms | Craft CMS: GraphQL Asset Mutation Privilege Escalation | high | 0.0 | 0% |
| CVE-2026-48010 | shopware/core, shopware/platform | Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts | medium | 6.5 | 0% |
| CVE-2026-42609 | getgrav/grav | Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic | high | 8.1 | 0% |
| CVE-2026-27198 | getformwork/formwork | Formwork Improperly Managed Privileges in User creation | high | 8.8 | 0% |
| CVE-2025-0177 | javo-core (WordPress plugin) | The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the | critical | 9.8 | 0% |
| CVE-2026-57995 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold | high | 8.8 | 0% |
| CVE-2024-8246 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | high | 8.8 | 0% |
| CVE-2024-13343 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_a | high | 8.8 | 0% |
| CVE-2026-85990 | leantime/leantime | Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods | high | 8.8 | 0% |
| CVE-2023-43663 | prestashop/prestashop | PrestaShop allows users to uninstall modules from backoffice, even with low rights | medium | 4.3 | 0% |
| CVE-2022-3419 | automatic-user-roles-switcher (WordPress plugin) | The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticat | medium | 6.5 | 0% |
| CVE-2024-13835 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. | high | 7.2 | 0% |
| CVE-2026-35671 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: IDOR Account Takeover | high | 8.8 | 0% |
| CVE-2024-2297 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insuffici | high | 7.1 | 0% |
| CVE-2024-3137 | uvdesk/core-framework | UVDesk Community Helpdesk Improper Privilege Management | high | 7.1 | 0% |
| CVE-2026-42844 | getgrav/grav | Low-privileged Grav API users can create super-admin accounts via blueprint-upload | high | 0.0 | 0% |
| CVE-2025-3438 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all ver | medium | 6.5 | 0% |
| CVE-2026-47744 | shopper/framework | Shopper: Authorization bypass and RBAC privilege escalation in team settings | critical | 9.9 | 0% |
| CVE-2020-15248 | october/backend | Privilege escalation by backend users assigned to the default "Publisher" system role | medium | 4.0 | 0% |
| CVE-2026-34989 | ci4-cms-erp/ci4ms | CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.0 | 0% |
| CVE-2026-46696 | october/system | October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls | low | 3.3 | 0% |
| CVE-2025-13534 | wsdesk (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, an | medium | 6.3 | 0% |
| CVE-2025-57759 | contao/contao, contao/core-bundle | Contao does not properly manage privileges for page and article fields | medium | 4.3 | 0% |
| CVE-2024-31556 | reportico-web/reportico | Reportico Web fails to invalidate cookies upon logout | medium | 6.5 | 0% |
| CVE-2026-8327 | concrete5/concrete5 | Concrete CMS has a session-hardening bypass and allows password change without reauthorization | medium | 0.0 | 0% |
| CVE-2025-65621 | snipe/snipe-it | Snipe-IT is vulnerable to stored cross-site scripting | medium | 5.4 | 0% |
| GHSA-4r76-xr68-w7m7 | typo3/cms | TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts | high | 8.8 | – |
| GHSA-9rx9-7fmh-gj3g | typo3/cms-core | TYPO3 Broken Access Control in Localization Handling | medium | 6.5 | – |
| GHSA-v5jp-4h2p-j2p4 | typo3/cms | Privilege Escalation in TYPO3 CMS | medium | 6.5 | – |