Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1289 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl | medium | 6.5 | 0% |
| CVE-2024-45233 | in2code/powermail | Powermail TYPO3 extension Broken Access Control in the OutputController | high | 7.3 | 0% |
| CVE-2023-6731 | wp-show-posts (WordPress plugin) | The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX funct | medium | 4.3 | 0% |
| CVE-2024-13646 | single-user-chat (WordPress plugin) | The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to ins | high | 8.1 | 0% |
| CVE-2026-55519 | snipe/snipe-it | Snipe-IT has Improper Authorization in File Deletion (IDOR) | low | 0.0 | 0% |
| CVE-2025-8401 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2025-4519 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missin | high | 8.8 | 0% |
| CVE-2026-50279 | craftcms/cms | Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap | high | 0.0 | 0% |
| CVE-2026-55212 | pimcore/studio-backend-bundle | Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation | high | 7.1 | 0% |
| CVE-2024-11768 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password vali | medium | 5.3 | 0% |
| CVE-2024-50701 | nilsteampassnet/teampass | TeamPass does not properly check whether a folder is in a user's allowed folders list | medium | 4.3 | 0% |
| CVE-2024-9531 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2021-3991 | dolibarr/dolibarr | Improper Authorization in dolibarr/dolibarr | medium | 4.3 | 0% |
| CVE-2026-47744 | shopper/framework | Shopper: Authorization bypass and RBAC privilege escalation in team settings | critical | 9.9 | 0% |
| CVE-2024-13692 | woo-refund-and-exchange-lite (WordPress plugin) | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPre | medium | 5.4 | 0% |
| CVE-2026-32300 | opensource-workshop/connect-cms | Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information | high | 8.1 | 0% |
| CVE-2024-50702 | nilsteampassnet/teampass | TeamPass mail_me operation authorization issue | medium | 5.4 | 0% |
| CVE-2026-90935 | froxlor/froxlor | Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API | medium | 4.3 | 0% |
| CVE-2026-33162 | craftcms/cms | Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions | medium | 0.0 | 0% |
| CVE-2024-44314 | tastyigniter/tastyigniter | TastyIgniter Has an Incorrect Access Control Vulnerability | medium | 6.5 | 0% |
| CVE-2024-48897 | moodle/moodle | moodle: IDOR in edit/delete RSS feed | medium | 6.5 | 0% |
| CVE-2024-48901 | moodle/moodle | moodle: IDOR when fetching report schedules | medium | 4.3 | 0% |
| CVE-2024-1803 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 4.3 | 0% |
| CVE-2025-11227 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and | medium | 6.5 | 0% |
| CVE-2025-62520 | mantisbt/mantisbt | MantisBT unauthorized disclosure of private project column configuration | medium | 4.3 | 0% |
| CVE-2026-47740 | shopper/framework | shopper/framework: Authorization bypass in multiple Livewire admin components | high | 8.1 | 0% |
| CVE-2025-7221 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 0% |
| CVE-2024-13724 | wallet-system-for-woocommerce (WordPress plugin) | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2026-34738 | wwbn/avideo | AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter | medium | 4.3 | 0% |
| CVE-2025-9294 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missi | medium | 4.3 | 0% |
| CVE-2025-62401 | moodle/moodle | Moodle has a time restriction bypass | medium | 5.4 | 0% |
| CVE-2026-42202 | almirhodzic/nova-toggle-5 | nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields | medium | 6.5 | 0% |
| CVE-2026-45620 | wwbn/avideo | AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024 | medium | 5.3 | 0% |
| GHSA-772m-43f3-hmf8 | typo3/cms | TYPO3 Broken Access Control in Localization Handling | medium | 6.5 | – |
| GHSA-vpr3-rc99-2wpr | typo3/cms | Information Disclosure in TYPO3 Backend | medium | 5.3 | – |
| GHSA-8wx3-8m4x-g5h4 | friendsofsymfony/user-bundle | FOSUserBundle User Identity Validation Vulnerability | medium | 0.0 | – |
| GHSA-p9mp-vq4v-v5m5 | ezsystems/ezpublish-legacy | eZ Publish Legacy Passwordless login for LDAP users | high | 0.0 | – |