Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-52837 | alextselegidis/easyappointments | Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page | medium | 0.0 | 0% |
| CVE-2025-14844 | restrict-content (WordPress plugin) | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, | high | 8.2 | 0% |
| CVE-2026-56345 | wwbn/avideo | AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, a | high | 8.1 | 0% |
| CVE-2024-22305 | kali-forms (WordPress plugin) | Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms | high | 7.5 | 0% |
| CVE-2026-52820 | kimai/kimai | Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass | medium | 0.0 | 0% |
| CVE-2026-81892 | easycorp/easyadmin-bundle | EasyAdmin custom-action dispatcher bypasses access_control on other routes | high | 8.1 | 0% |
| CVE-2024-10868 | enteraddons (WordPress plugin) | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, | medium | 4.3 | 0% |
| CVE-2023-3700 | alextselegidis/easyappointments | Easy!Appointments Improper Access Control vulnerability | medium | 6.3 | 0% |
| CVE-2025-11924 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in ver | high | 7.5 | 0% |
| CVE-2026-35445 | winter/wn-backend-module | Winter: Authenticated backend users can bypass Users controller permission checks | high | 0.0 | 0% |
| CVE-2024-11285 | jobcareer (WordPress plugin) | The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. Th | critical | 9.8 | 0% |
| CVE-2024-4750 | buddyboss (WordPress plugin) | The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulatin | medium | 5.3 | 0% |
| CVE-2023-47191 | youzify (WordPress plugin) | Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & M | medium | 6.5 | 0% |
| CVE-2024-5977 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions | medium | 5.4 | 0% |
| CVE-2024-13372 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 5.3 | 0% |
| CVE-2026-52821 | kimai/kimai | Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects | medium | 0.0 | 0% |
| CVE-2026-52826 | kimai/kimai | Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation | medium | 0.0 | 0% |
| CVE-2026-82395 | sulu/sulu | Sulu: Media move/update authorization bypass (IDOR) | medium | 0.0 | 0% |
| CVE-2024-4279 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Cou | medium | 6.5 | 0% |
| CVE-2026-76089 | verbb/formie | Formie: Missing authorization on sent notification resend modal exposes submission PII | high | 7.7 | 0% |
| CVE-2026-64662 | statamic/cms | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries | medium | 6.5 | 0% |
| CVE-2024-5639 | metronet-profile-picture (WordPress plugin) | The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 | medium | 4.3 | 0% |
| CVE-2026-76087 | verbb/formie | Formie: Unauthenticated users can overwrite incomplete submissions via submit action | high | 8.2 | 0% |
| CVE-2025-3874 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi | medium | 6.5 | 0% |
| CVE-2025-12918 | yungifez/skuul | Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice | low | 3.1 | 0% |
| CVE-2023-6384 | user-profile-avatar (WordPress plugin) | The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update ar | medium | 4.3 | 0% |
| CVE-2026-47198 | paymenter/paymenter | Paymenter has URL parameter injection that bypasses paid plan limits at checkout | high | 8.5 | 0% |
| CVE-2024-13428 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 5.3 | 0% |
| CVE-2023-7198 | wp-dashboard-notes (WordPress plugin) | The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authe | medium | 4.3 | 0% |
| CVE-2025-3640 | moodle/moodle | Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users | medium | 4.3 | 0% |
| CVE-2024-9700 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Referen | medium | 5.3 | 0% |
| CVE-2024-1289 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl | medium | 6.5 | 0% |
| CVE-2024-10780 | restaurant-cafe-addon-for-elementor (WordPress plugin) | The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1 | medium | 4.3 | 0% |
| CVE-2024-10798 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2024-12132 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2025-4855 | support-board (WordPress plugin) | The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default se | critical | 9.8 | 0% |
| CVE-2024-12061 | events-addon-for-elementor (WordPress plugin) | The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via th | medium | 4.3 | 0% |
| CVE-2026-35671 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: IDOR Account Takeover | high | 8.8 | 0% |
| CVE-2026-47743 | shopper/framework | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | high | 8.7 | 0% |
| CVE-2024-40633 | sylius/sylius | Sylius has a security vulnerability via adjustments API endpoint | high | 7.5 | 0% |
| CVE-2026-55516 | snipe/snipe-it | Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update | high | 7.7 | 0% |
| CVE-2024-12335 | avada-builder (WordPress plugin) | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the | medium | 4.3 | 0% |
| CVE-2023-6897 | ean-for-woocommerce (WordPress plugin) | The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 v | medium | 4.3 | 0% |
| CVE-2024-13558 | woo-rfq-for-woocommerce (WordPress plugin) | The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2026-53673 | buddypress/buddypress | BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter | high | 8.1 | 0% |
| CVE-2025-1667 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on | high | 8.8 | 0% |
| CVE-2025-48205 | sjbr/sr-feuser-register | The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference | high | 8.6 | 0% |
| CVE-2025-48207 | renolit/reint-downloadmanager | reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference | medium | 5.3 | 0% |
| CVE-2024-10670 | primary-addon-for-elementor (WordPress plugin) | The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via t | medium | 4.3 | 0% |
| CVE-2026-50283 | craftcms/cms | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement | medium | 0.0 | 0% |