Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24501 | workreap (WordPress plugin) | The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perf | high | 8.1 | 1% |
| CVE-2021-24839 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allo | high | 7.5 | 1% |
| CVE-2021-4346 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This i | critical | 9.8 | 1% |
| CVE-2021-24831 | tab (WordPress plugin) | All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenti | high | 7.5 | 1% |
| CVE-2024-2473 | wps-hide-login (WordPress plugin) | The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due t | medium | 5.3 | 1% |
| CVE-2024-2782 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized | high | 7.5 | 1% |
| CVE-2020-13677 | drupal/core | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which ma | high | 7.5 | 1% |
| CVE-2022-0203 | bytefury/crater | Missing Authorization in Crater Invoice | medium | 5.3 | 1% |
| CVE-2022-0611 | snipe/snipe-it | Improper Privilege Management in Snipe-IT | high | 8.8 | 1% |
| CVE-2024-7950 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusio | critical | 9.8 | 1% |
| CVE-2021-4361 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job | high | 8.8 | 1% |
| CVE-2021-25093 | link-library (WordPress plugin) | The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to d | high | 7.5 | 1% |
| CVE-2022-0580 | librenms/librenms | Improper Access Control in librenms | high | 7.1 | 1% |
| CVE-2024-4352 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing cap | high | 8.8 | 1% |
| CVE-2020-36698 | security-\&-malware-scan (WordPress plugin) | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and includin | high | 8.8 | 1% |
| CVE-2021-24352 | simple-301-redirects (WordPress plugin) | The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making i | high | 8.8 | 1% |
| CVE-2026-42569 | nabeel/phpvms | phpVMS has an /importer authorization bypass causing full database wipe | critical | 9.4 | 1% |
| CVE-2024-8349 | uncanny-groups-for-learndash (WordPress plugin) | The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. T | high | 7.2 | 1% |
| CVE-2022-0919 | salon-booking-system (WordPress plugin) | The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any | medium | 5.3 | 1% |
| CVE-2021-34647 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/i | medium | 6.5 | 1% |
| CVE-2022-25355 | ec-cube/ec-cube | EC-CUBE improperly handles HTTP Host header values | medium | 5.3 | 1% |
| CVE-2024-0683 | bulgarisation-for-woocommerce (WordPress plugin) | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several func | high | 7.3 | 1% |
| CVE-2020-14205 | divebook (WordPress plugin) | The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization c | medium | 5.3 | 1% |
| CVE-2025-1304 | newsblogger (WordPress theme) | The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and | high | 8.8 | 1% |
| CVE-2020-36725 | ti-woocommerce-wishlist (WordPress plugin) | The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versi | high | 8.8 | 1% |
| CVE-2020-11671 | nilsteampassnet/teampass | Missing Authorization in TeamPass | high | 8.1 | 1% |
| CVE-2021-4341 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, | critical | 9.8 | 1% |
| CVE-2020-29604 | mantisbt/mantisbt | MantisBT Missing Authorization access check in bug_actiongroup.php | medium | 6.5 | 1% |
| CVE-2021-32716 | shopware/platform, shopware/core | Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.4 | 1% |
| CVE-2021-24353 | simple-301-redirects (WordPress plugin) | The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making i | high | 8.8 | 1% |
| CVE-2021-20283 | moodle/moodle | Missing permission check in Moodle | medium | 4.3 | 1% |
| CVE-2024-6845 | chatbot-with-chatgpt (WordPress plugin) | The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthentica | medium | 5.3 | 1% |
| CVE-2019-14883 | moodle/moodle | Moodle Email media URL tokens were not checking for user status | medium | 5.3 | 1% |
| CVE-2016-10996 | optinmonster (WordPress plugin) | The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak. | medium | 5.3 | 1% |
| CVE-2020-24941 | laravel/framework | Improper Input Validation in Laravel | high | 7.5 | 1% |
| CVE-2022-4940 | wc-multivendor-membership (WordPress plugin) | The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.1 | high | 7.3 | 1% |
| CVE-2020-36696 | product-input-fields-for-woocommerce (WordPress plugin) | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the | high | 7.5 | 1% |
| CVE-2022-0588 | librenms/librenms | Missing Authorization in librenms/librenms | medium | 6.5 | 1% |
| CVE-2021-3992 | kevinpapst/kimai2 | kimai2 is vulnerable to Improper Access Control | medium | 6.5 | 1% |
| CVE-2022-1511 | snipe/snipe-it | Improper Access Control in snipe/snipe-it | medium | 6.5 | 1% |
| CVE-2022-0579 | snipe/snipe-it | Improper Privilege Management in Snipe-IT | medium | 6.5 | 1% |
| CVE-2021-24757 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to | medium | 5.3 | 1% |
| CVE-2022-0404 | material-design-for-contact-form-7 (WordPress plugin) | The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notic | medium | 6.5 | 1% |
| CVE-2025-1639 | arolax (WordPress plugin) | The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing cap | high | 8.8 | 1% |
| CVE-2022-22111 | bottelet/flarepoint | Missing Authorization in DayByDay CRM | high | 8.8 | 1% |
| CVE-2021-24872 | get-custom-field-values (WordPress plugin) | The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata withou | medium | 6.5 | 1% |
| CVE-2022-25810 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utili | medium | 6.5 | 1% |
| CVE-2023-1337 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the | medium | 4.3 | 1% |
| CVE-2023-22248 | magento/community-edition, magento/project-community-edition | Magento Open Source affected by Improper Input Validation | high | 7.5 | 1% |
| CVE-2024-4351 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing cap | high | 8.8 | 1% |