Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-36906 | quiz-master-next (WordPress plugin) | Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress. | low | 2.7 | 1% |
| CVE-2024-13694 | smart-wishlist-for-more-convert (WordPress plugin) | The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insec | high | 7.5 | 1% |
| CVE-2024-8485 | rest-api-to-miniprogram (WordPress plugin) | The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and includ | critical | 9.8 | 1% |
| CVE-2023-0689 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versio | medium | 4.3 | 1% |
| CVE-2024-0366 | starbox (WordPress plugin) | The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and in | medium | 4.3 | 1% |
| CVE-2024-2538 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 5.4 | 1% |
| CVE-2026-54178 | backpack/crud | Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk | high | 8.1 | 1% |
| CVE-2023-1125 | ruby-help-desk (WordPress plugin) | The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allo | medium | 6.5 | 1% |
| CVE-2023-48865 | reportico-web/reportico | Reportico affected by Incorrect Access Control | medium | 6.5 | 1% |
| CVE-2023-28334 | moodle/moodle | Moodle may allow authenticated users to enumerate other user's names via learning plans page | medium | 4.3 | 1% |
| CVE-2023-1911 | blocksy-companion (WordPress plugin) | The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be | medium | 4.3 | 1% |
| CVE-2022-40205 | wpforo (WordPress plugin) | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or | medium | 5.4 | 1% |
| CVE-2024-10855 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denia | high | 8.1 | 1% |
| CVE-2026-53639 | sylius/sylius | Sylius: IDOR on Shop Payment Request API endpoints | medium | 0.0 | 1% |
| CVE-2023-36238 | bagisto/bagisto | Bagisto vulnerable to Insecure Direct Object Reference (IDOR) | medium | 6.5 | 1% |
| CVE-2024-11284 | jobcareer (WordPress plugin) | The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. Th | critical | 9.8 | 1% |
| CVE-2024-43438 | moodle/moodle | Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users | high | 7.5 | 1% |
| CVE-2023-6226 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, | medium | 4.3 | 1% |
| CVE-2023-1463 | nilsteampassnet/teampass | Improper Authorization in nilsteampassnet/teampass | medium | 5.4 | 1% |
| CVE-2023-2173 | badgeos (WordPress plugin) | The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to | medium | 6.5 | 1% |
| CVE-2023-2172 | badgeos (WordPress plugin) | The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to | medium | 4.3 | 1% |
| CVE-2021-36865 | quiz-master-next (WordPress plugin) | Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers t | low | 3.8 | 1% |
| CVE-2024-10671 | button-block (WordPress plugin) | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versi | medium | 4.3 | 1% |
| CVE-2022-40206 | wpforo (WordPress plugin) | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or | medium | 6.3 | 1% |
| CVE-2021-36400 | moodle/moodle | Moodle has Incorrect Default Permissions | medium | 5.3 | 1% |
| CVE-2025-67165 | pagekit/pagekit | Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component | critical | 9.8 | 0% |
| CVE-2024-11181 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inc | medium | 4.3 | 0% |
| CVE-2024-0872 | watu-quiz (WordPress plugin) | The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu- | medium | 4.3 | 0% |
| CVE-2023-4836 | wordpress-file-sharing-plugin (WordPress plugin) | The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing u | medium | 4.3 | 0% |
| CVE-2024-8428 | forumwp (WordPress plugin) | The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Referenc | high | 8.8 | 0% |
| CVE-2024-9637 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions | high | 8.8 | 0% |
| CVE-2024-39319 | aimeos/ai-controller-frontend | IDOR vulnerability in account profile page | medium | 5.3 | 0% |
| CVE-2024-47047 | in2code/powermail | powermail TYPO3 extension has Insecure Direct Object Reference | medium | 5.3 | 0% |
| CVE-2023-6824 | wp-customer-area (WordPress plugin) | The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any u | medium | 6.5 | 0% |
| CVE-2023-3869 | wpdiscuz (WordPress plugin) | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComme | medium | 5.3 | 0% |
| CVE-2023-3998 | wpdiscuz (WordPress plugin) | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate fu | medium | 5.3 | 0% |
| CVE-2024-9687 | two-factor-login-telegram (WordPress plugin) | The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to i | high | 8.8 | 0% |
| CVE-2024-10778 | stax-buddy-builder (WordPress plugin) | The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and in | medium | 4.3 | 0% |
| CVE-2024-1640 | bit-form (WordPress plugin) | The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulne | medium | 5.3 | 0% |
| CVE-2026-25497 | craftcms/cms | Craft CMS: GraphQL Asset Mutation Privilege Escalation | high | 0.0 | 0% |
| CVE-2024-13719 | pepro-ultimate-invoice (WordPress plugin) | The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2 | medium | 5.3 | 0% |
| CVE-2024-43431 | moodle/moodle | Moodle's IDOR in badges allows deletion of arbitrary badges | high | 7.5 | 0% |
| CVE-2023-6969 | user-shortcodes-plus (WordPress plugin) | The User Shortcodes Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.2 | medium | 4.3 | 0% |
| CVE-2023-6983 | shortcode-to-display-post-and-user-data (WordPress plugin) | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Refere | medium | 4.3 | 0% |
| CVE-2024-50703 | nilsteampassnet/teampass | TeamPass privileges issue | medium | 5.4 | 0% |
| CVE-2023-6506 | wp-2fa (WordPress plugin) | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions | medium | 4.3 | 0% |
| CVE-2026-28696 | craftcms/cms | Craft CMS has IDOR via GraphQL @parseRefs | high | 0.0 | 0% |
| CVE-2026-42609 | getgrav/grav | Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic | high | 8.1 | 0% |
| CVE-2024-4274 | essential-real-estate (WordPress plugin) | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_prope | medium | 4.3 | 0% |
| CVE-2026-54180 | backpack/crud | Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) | high | 7.6 | 0% |