Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6397 | instawp-connect (WordPress plugin) | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and | critical | 9.8 | 1% |
| CVE-2024-2112 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Expos | medium | 5.9 | 1% |
| CVE-2022-47408 | fixpunkt/fp-newsletter | Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter) | critical | 9.1 | 1% |
| CVE-2024-10097 | loginizer (WordPress plugin) | The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9 | high | 8.1 | 1% |
| CVE-2026-47156 | mantisbt/mantisbt | MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator | critical | 0.0 | 1% |
| CVE-2024-5432 | lifeline-donation (WordPress plugin) | The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to in | critical | 9.8 | 1% |
| CVE-2022-43690 | concrete5/concrete5 | Concrete CMS vulnerable to Improper Authentication | medium | 6.3 | 1% |
| CVE-2022-1349 | wpqa-builder (WordPress plugin) | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value p | medium | 4.3 | 1% |
| CVE-2025-46348 | yeswiki/yeswiki | YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download | critical | 10.0 | 1% |
| CVE-2026-54176 | backpack/crud | Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check | medium | 6.5 | 1% |
| CVE-2023-4939 | salesmanago (WordPress plugin) | The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a wea | medium | 5.3 | 1% |
| CVE-2024-9946 | super-socializer (WordPress plugin) | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in | high | 8.1 | 1% |
| CVE-2019-15648 | insert-or-embed-articulate-content-into-wordpress (WordPress plugin) | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam | medium | 6.5 | 1% |
| CVE-2024-51996 | symfony/security-http, symfony/symfony | Symfony has an Authentication Bypass via RememberMe | high | 7.5 | 1% |
| CVE-2024-37893 | grumpydictator/firefly-iii | Firefly III has a MFA bypass in oauth flow | medium | 5.9 | 1% |
| CVE-2024-5658 | born05/craft-twofactorauthentication | Improper Authentication in CraftCMS two factor authentication plugin | medium | 4.8 | 1% |
| CVE-2024-56329 | joelbutcher/socialstream | Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback | high | 0.0 | 1% |
| CVE-2026-52827 | kimai/kimai | Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP | high | 0.0 | 1% |
| CVE-2024-12919 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to A | critical | 9.8 | 1% |
| CVE-2023-6155 | quiz-maker (WordPress plugin) | The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unau | medium | 5.3 | 1% |
| CVE-2023-47127 | typo3/cms-core | TYPO3 vulnerable to Weak Authentication in Session Handling | medium | 4.2 | 1% |
| CVE-2022-0985 | moodle/moodle | Improper Authentication in moodle | medium | 4.3 | 1% |
| CVE-2023-5844 | pimcore/admin-ui-classic-bundle | pimcore/admin-ui-classic-bundle Unverified Password Change | medium | 4.3 | 1% |
| CVE-2026-77567 | filament/filament | Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled | high | 8.1 | 1% |
| CVE-2024-10114 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.7.7. This | high | 8.1 | 1% |
| CVE-2026-64665 | statamic/cms | Statamic: Account takeover via OAuth email matching without email-verification check | high | 8.1 | 1% |
| CVE-2025-47275 | auth0/auth0-php | Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK | critical | 9.1 | 1% |
| CVE-2023-4242 | full-customer (WordPress plugin) | The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including | medium | 4.3 | 1% |
| CVE-2024-9947 | profilepress (WordPress plugin) | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due t | high | 8.1 | 1% |
| CVE-2026-56737 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ's two-factor authentication login bypasses the password factor | high | 8.1 | 1% |
| CVE-2024-10020 | social-login (WordPress plugin) | The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. | high | 8.1 | 1% |
| CVE-2022-23501 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Weak Authentication in Frontend Login | medium | 5.9 | 1% |
| CVE-2026-29093 | wwbn/avideo | AVideo: Unauthenticated PHP session store exposed to host network via published memcached port | high | 8.1 | 1% |
| CVE-2025-61922 | prestashop/ps_checkout | PrestaShop Checkout allows customer account takeover via email | critical | 9.1 | 1% |
| CVE-2023-50714 | yiisoft/yii2-authclient | yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable | medium | 6.8 | 0% |
| CVE-2024-13528 | emails-verification-for-woocommerce (WordPress plugin) | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2024-11087 | social-login (WordPress plugin) | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication | high | 8.1 | 0% |
| CVE-2024-9927 | woocommerce-order-proposal (WordPress plugin) | The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and inclu | high | 7.2 | 0% |
| CVE-2024-41800 | craftcms/cms | Craft CMS Allows TOTP Token To Stay Valid After Use | medium | 4.8 | 0% |
| CVE-2026-56345 | wwbn/avideo | AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, a | high | 8.1 | 0% |
| CVE-2024-7870 | pixelyoursite (WordPress plugin) | The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Informa | medium | 6.5 | 0% |
| CVE-2026-33716 | wwbn/avideo | AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php | critical | 9.4 | 0% |
| CVE-2026-45754 | symfony/lox24-notifier, symfony/mailjet-mailer, symfony/symfony | Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection | medium | 0.0 | 0% |
| CVE-2022-3119 | oauth-client-single-sign-on (WordPress plugin) | The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could a | high | 7.5 | 0% |
| CVE-2017-8879 | dolibarr/dolibarr | Dolibarr allows password changes without supplying the current password | medium | 6.8 | 0% |
| CVE-2026-27939 | statamic/cms | Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass | high | 8.8 | 0% |
| CVE-2025-25227 | joomla/joomla-cms | Joomla CMS Multi-Factor Authentication Bypass | high | 7.5 | 0% |
| CVE-2025-69197 | pterodactyl/panel | Pterodactyl TOTPs can be reused during validity window | medium | 6.5 | 0% |
| CVE-2025-12998 | codingms/modules | TYPO3 Modules Extension has Improper Authentication vulnerability | high | 0.0 | 0% |
| CVE-2026-62232 | getgrav/grav | Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge | high | 7.4 | 0% |