Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-22208 | phpmyfaq/phpmyfaq | phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes | medium | 6.5 | 1% |
| CVE-2024-47053 | mautic/core | Mautic allows Improper Authorization in Reporting API | high | 7.7 | 1% |
| CVE-2021-24282 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJA | medium | 6.3 | 1% |
| CVE-2024-45132 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 6.5 | 1% |
| CVE-2021-24842 | bulk-datetime-change (WordPress plugin) | The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) lis | medium | 5.4 | 1% |
| CVE-2021-24652 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to pe | medium | 6.5 | 1% |
| CVE-2022-0334 | moodle/moodle | Insufficient user authorization in Moodle | medium | 4.3 | 1% |
| CVE-2021-4194 | ssddanbrown/bookstack | bookstack is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2021-25954 | dolibarr/dolibarr | Improper Access Control in Dolibarr | medium | 4.3 | 1% |
| CVE-2022-47408 | fixpunkt/fp-newsletter | Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter) | critical | 9.1 | 1% |
| CVE-2023-46906 | juzaweb/cms | juzawebCMS Incorrect Access Control vulnerability | medium | 4.9 | 1% |
| CVE-2021-24207 | wp-page-builder (WordPress plugin) | By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pa | medium | 4.3 | 1% |
| CVE-2025-24409 | magento/community-edition, magento/project-community-edition | Adobe Commerce Improper Authorization vulnerability | high | 8.2 | 1% |
| CVE-2024-25108 | pixelfed/pixelfed | Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions | critical | 9.9 | 1% |
| CVE-2021-4334 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check | high | 8.8 | 1% |
| CVE-2022-0775 | woocommerce (WordPress plugin) | The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenti | medium | 4.3 | 1% |
| CVE-2024-32003 | winter/wn-dusk-plugin | Dusk plugin may allow unfettered user authentication in misconfigured installs | high | 8.8 | 1% |
| CVE-2025-5071 | ai-engine (WordPress plugin) | The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on | high | 8.8 | 1% |
| CVE-2021-24281 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_acti | medium | 4.3 | 1% |
| CVE-2021-34648 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Rout | medium | 6.4 | 1% |
| CVE-2022-0762 | microweber/microweber | Exposure of Resource to Wrong Sphere in microweber | medium | 4.3 | 1% |
| CVE-2024-1479 | wp-show-posts (WordPress plugin) | The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the w | medium | 5.3 | 1% |
| CVE-2023-29288 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-29295 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-29296 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-0298 | grumpydictator/firefly-iii | Improper Authorization in grumpydictator/firefly-iii | medium | 6.5 | 1% |
| CVE-2022-0333 | moodle/moodle | Insufficient user authorization in Moodle | low | 3.8 | 1% |
| CVE-2021-40692 | moodle/moodle | Moodle Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2022-0720 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update oth | medium | 5.4 | 1% |
| CVE-2023-3814 | advanced-file-manager (WordPress plugin) | The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site ad | medium | 4.9 | 1% |
| CVE-2022-1589 | all-in-one-login (WordPress plugin) | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updati | high | 7.5 | 1% |
| CVE-2023-25575 | api-platform/core | api-platform/core's secured properties may be accessible within collections | high | 7.7 | 1% |
| CVE-2025-54263 | magento/community-edition, magento/project-community-edition | Magento provides incorrect authorization through a security feature bypass | high | 8.1 | 1% |
| CVE-2026-48489 | symfony/security-http, symfony/symfony | Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes | high | 0.0 | 1% |
| CVE-2025-49556 | magento/community-edition, magento/project-community-edition | Magento has incorrect authorization issue that leads to arbitrary file system read | high | 7.5 | 1% |
| CVE-2024-45128 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 5.4 | 1% |
| CVE-2025-27188 | magento/community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2026-82394 | sulu/sulu | Sulu: Fix authorization bypass when creating preview links | medium | 0.0 | 1% |
| CVE-2024-1452 | generateblocks (WordPress plugin) | The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2 via Quer | medium | 4.3 | 1% |
| CVE-2023-22251 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2022-0984 | moodle/moodle | Missing authorization in Moodle | medium | 4.3 | 1% |
| CVE-2022-0985 | moodle/moodle | Improper Authentication in moodle | medium | 4.3 | 1% |
| CVE-2025-54265 | magento/community-edition, magento/project-community-edition | Magento allows incorrect authorization | medium | 5.9 | 1% |
| CVE-2025-24421 | magento/community-edition, magento/project-community-edition | Magento Incorrect Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2025-24436 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2023-4242 | full-customer (WordPress plugin) | The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including | medium | 4.3 | 1% |
| CVE-2023-3574 | pimcore/customer-management-framework-bundle | Pimcore Customer Management Framework vulnerable to Improper Authorization in Rules Controller | medium | 6.5 | 1% |
| CVE-2024-45125 | magento/community-edition | Magento Open Source Incorrect Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2024-1307 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as l | medium | 6.5 | 1% |
| CVE-2023-6963 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it po | medium | 5.3 | 1% |