Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-31475 | give (WordPress plugin) | Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. | medium | 5.5 | 1% |
| CVE-2019-10187 | moodle/moodle | Moodle Ability to delete glossary entries that belong to another glossary | medium | 4.3 | 1% |
| CVE-2019-10188 | moodle/moodle | moodle Improper Access Control | medium | 4.0 | 1% |
| CVE-2019-10189 | moodle/moodle | moodle Improper Access Control | medium | 4.0 | 1% |
| CVE-2021-4352 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsetti | medium | 5.3 | 1% |
| CVE-2022-4700 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX actio | medium | 5.4 | 1% |
| CVE-2021-24859 | user-meta-shortcodes (WordPress plugin) | The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access | medium | 4.3 | 1% |
| CVE-2022-4702 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX actio | medium | 5.4 | 1% |
| CVE-2022-4704 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action i | medium | 5.4 | 1% |
| CVE-2020-13676 | drupal/core | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclo | medium | 6.5 | 1% |
| CVE-2024-0212 | cloudflare (WordPress plugin) | The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower priv | high | 8.1 | 1% |
| CVE-2021-24781 | image-source-control (WordPress plugin) | The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields o | medium | 4.3 | 1% |
| CVE-2023-2159 | cmp-coming-soon-maintenance (WordPress plugin) | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A | medium | 5.3 | 1% |
| CVE-2020-36699 | quick-page\/post-redirect (WordPress plugin) | The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_qu | medium | 4.3 | 1% |
| CVE-2025-24424 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 6.5 | 1% |
| CVE-2022-41652 | quiz-and-survey-master (WordPress plugin) | Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 6.5 | 1% |
| CVE-2022-41155 | iq-block-country (WordPress plugin) | Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress. | medium | 5.3 | 1% |
| CVE-2024-44313 | tastyigniter/tastyigniter | TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function | high | 8.1 | 1% |
| CVE-2011-1762 | WordPress core | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This | medium | 6.5 | 1% |
| CVE-2021-4089 | snipe/snipe-it | snipe-it is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2021-36913 | wpcf7-redirect (WordPress plugin) | Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress a | high | 7.5 | 1% |
| CVE-2021-4194 | ssddanbrown/bookstack | bookstack is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2021-25954 | dolibarr/dolibarr | Improper Access Control in Dolibarr | medium | 4.3 | 1% |
| CVE-2022-4711 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX actio | medium | 4.3 | 1% |
| CVE-2021-34627 | wp-upload-restriction (WordPress plugin) | A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated user | medium | 4.3 | 1% |
| CVE-2021-4364 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add | medium | 4.3 | 1% |
| CVE-2021-34626 | wp-upload-restriction (WordPress plugin) | A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delet | medium | 4.3 | 1% |
| CVE-2026-27591 | winter/wn-backend-module | Winter vulnerable to privilege escalation by authenticated backend users | critical | 9.9 | 1% |
| CVE-2023-22487 | flarum/mentions | Flarum post mentions can be used to read any post on the forum without access control | high | 7.7 | 1% |
| CVE-2024-1294 | sunshine-photo-cart (WordPress plugin) | The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all | medium | 5.3 | 1% |
| CVE-2021-24698 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads | medium | 4.3 | 1% |
| CVE-2021-24816 | phoenix-media-rename (WordPress plugin) | The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could | medium | 4.3 | 1% |
| CVE-2024-0377 | lifterlms (WordPress plugin) | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 1% |
| CVE-2024-1668 | avada (WordPress theme) | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up t | medium | 6.5 | 1% |
| CVE-2024-36676 | ssddanbrown/bookstack | BookStack Incorrect Access Control vulnerability | high | 8.2 | 1% |
| CVE-2021-24500 | workreap (WordPress plugin) | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct obj | high | 8.1 | 1% |
| CVE-2024-45118 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 6.5 | 1% |
| CVE-2022-0179 | snipe/snipe-it | Incorrect Default Permissions and Improper Access Control in snipe-it | medium | 5.4 | 1% |
| CVE-2021-24635 | visual-link-preview (WordPress plugin) | The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displaye | medium | 5.4 | 1% |
| CVE-2025-24427 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 6.5 | 1% |
| CVE-2022-23981 | perfect-woocommerce-brands (WordPress plugin) | The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4). | medium | 4.3 | 1% |
| CVE-2022-29417 | shortpixel-adaptive-images (WordPress plugin) | Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low u | medium | 4.3 | 1% |
| CVE-2024-0631 | duitku-social-payment-gateway (WordPress plugin) | The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 5.3 | 1% |
| CVE-2021-4338 | 404-to-301 (WordPress plugin) | The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redir | medium | 6.4 | 1% |
| CVE-2022-4705 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action i | medium | 4.3 | 1% |
| CVE-2022-4708 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX acti | medium | 4.3 | 1% |
| CVE-2022-4709 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX actio | medium | 4.3 | 1% |
| CVE-2024-45124 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2021-42360 | starter-templates (WordPress plugin) | On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which include | high | 7.6 | 1% |
| CVE-2024-45133 | magento/community-edition | Magento Open Source Information Exposure vulnerability | low | 2.7 | 1% |