Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-16738 | mediawiki/core | MediaWiki information disclosure | medium | 5.3 | 2% |
| CVE-2021-36039 | magento/community-edition, magento/project-community-edition | Magento discloses sensitive information | medium | 6.5 | 2% |
| CVE-2026-24421 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) | medium | 6.5 | 2% |
| CVE-2019-14793 | meta-box (WordPress plugin) | The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file atta | medium | 6.5 | 2% |
| CVE-2020-15246 | october/cms | Local File Inclusion by unauthenticated users | high | 7.5 | 2% |
| CVE-2021-23803 | latte/latte | Incorrect Authorization in latte/latte | critical | 9.8 | 2% |
| CVE-2020-35849 | mantisbt/mantisbt | MantisBT Incorrect Authorization for bug_revision_view_page.php check | high | 7.5 | 2% |
| CVE-2020-25699 | moodle/moodle | Privilage Escalation in moodle | high | 7.5 | 2% |
| CVE-2018-25019 | learndash (WordPress plugin) | The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_a | high | 7.5 | 2% |
| CVE-2011-4297 | moodle/moodle | Moodle does not properly restrict comment capabilities | medium | 0.0 | 2% |
| CVE-2010-1617 | moodle/moodle | Moodle doesn't properly check role | low | 0.0 | 2% |
| CVE-2021-4356 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, | critical | 9.0 | 2% |
| CVE-2021-25002 | tipsacarrier (WordPress plugin) | The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenti | high | 7.5 | 2% |
| CVE-2021-25087 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unaut | high | 7.5 | 2% |
| CVE-2024-5324 | login\/signup-popup (WordPress plugin), otp-login-woocommerce-\&-gravity-forms (WordPress plugin), side-cart-woocommerce (WordPress plugin) +1 more | Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capabilit | high | 8.8 | 2% |
| CVE-2021-24977 | use-any-font (WordPress plugin) | The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing | medium | 6.1 | 1% |
| CVE-2021-24906 | protect-wp-admin (WordPress plugin) | The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow un | high | 7.5 | 1% |
| CVE-2021-24354 | simple-301-redirects (WordPress plugin) | A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin befo | high | 8.8 | 1% |
| CVE-2023-6700 | wp-gdpr-compliance (WordPress plugin) | The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capabili | high | 8.8 | 1% |
| CVE-2022-0920 | salon-booking-system (WordPress plugin) | The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could | high | 7.5 | 1% |
| CVE-2021-24163 | ninja-forms (WordPress plugin) | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protect | high | 8.8 | 1% |
| CVE-2021-24184 | tutor-lms (WordPress plugin) | Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing stud | high | 8.8 | 1% |
| CVE-2020-9455 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary ema | medium | 4.3 | 1% |
| CVE-2021-4362 | kiwi-social-share (WordPress plugin) | The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_ | critical | 9.8 | 1% |
| CVE-2021-4343 | ulisting (WordPress plugin) | The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including | critical | 9.8 | 1% |
| CVE-2021-4370 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated user | critical | 9.8 | 1% |
| CVE-2021-4381 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing securit | critical | 9.8 | 1% |
| CVE-2020-25701 | moodle/moodle | Privilage Escalation in moodle | medium | 5.3 | 1% |
| CVE-2021-4448 | kaswara (WordPress plugin) | The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insuf | high | 7.3 | 1% |
| CVE-2019-14786 | seo (WordPress plugin) | The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb paramet | medium | 6.5 | 1% |
| CVE-2022-4950 | cool-timeline (WordPress plugin), cryptocurrency-payment-\&-donation-box (WordPress plugin), cryptocurrency-widgets (WordPress plugin) +7 more | Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote c | high | 8.8 | 1% |
| CVE-2021-20281 | moodle/moodle | Moodle allowed some users without permission to view other users' full names | medium | 5.3 | 1% |
| CVE-2021-25075 | duplicate-page-or-post (WordPress plugin) | The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplica | low | 3.5 | 1% |
| CVE-2023-6985 | ai-assistant-by-10web (WordPress plugin) | The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 6.5 | 1% |
| CVE-2021-38312 | gutenberg-template-library-\&-redux-framework (WordPress plugin) | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoi | high | 7.1 | 1% |
| CVE-2021-24717 | automatorwp (WordPress plugin) | The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate autom | high | 8.8 | 1% |
| CVE-2014-6292 | in2code/femanager | TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users | medium | 0.0 | 1% |
| CVE-2020-25629 | moodle/moodle | Moodle incorrect access control | high | 8.8 | 1% |
| CVE-2021-20841 | ec-cube/ec-cube | EC-CUBE Improper access control in Management screen | medium | 6.5 | 1% |
| CVE-2022-42344 | magento/community-edition | Magento Improper input validation vulnerability | high | 8.8 | 1% |
| CVE-2021-20282 | moodle/moodle | Moodle Bypass email verification secret when confirming account registration | medium | 5.3 | 1% |
| CVE-2019-25142 | materialis (WordPress plugin), mesmerize (WordPress plugin) | The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesm | high | 8.8 | 1% |
| CVE-2025-1361 | ip2location-country-blocker (WordPress plugin) | The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.3 | high | 7.5 | 1% |
| CVE-2024-0679 | colormag (WordPress theme) | The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() func | medium | 6.5 | 1% |
| CVE-2022-2354 | wp-dbmanager (WordPress plugin) | The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite i | high | 7.2 | 1% |
| CVE-2020-13665 | drupal/core, drupal/drupal, drupal/core | Drupal Core Access bypass vulnerability | critical | 9.8 | 1% |
| CVE-2021-4337 | add-product-tabs (WordPress plugin), autopilot-seo (WordPress plugin), bulk-add-to-cart (WordPress plugin) +13 more | Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax | high | 8.8 | 1% |
| CVE-2022-1777 | filr (WordPress plugin) | The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any aut | high | 8.8 | 1% |
| CVE-2024-8289 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-e | critical | 9.8 | 1% |
| CVE-2021-24677 | find-my-blocks (WordPress plugin) | The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users | medium | 5.3 | 1% |