Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-9514 | idx-broker-platinum (WordPress plugin) | An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subs | medium | 6.5 | 1% |
| CVE-2023-2448 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_te | medium | 6.5 | 1% |
| CVE-2023-0556 | contentstudio (WordPress plugin) | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versi | critical | 9.8 | 1% |
| CVE-2021-4339 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.ph | high | 7.5 | 1% |
| CVE-2021-24851 | insert-pages (WordPress plugin) | The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary | medium | 4.3 | 1% |
| CVE-2022-2370 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the setting | medium | 6.5 | 1% |
| CVE-2024-11270 | wp-webinarsystem (WordPress plugin) | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check | high | 8.8 | 1% |
| CVE-2023-3244 | comments-like-dislike (WordPress plugin) | The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the r | medium | 4.3 | 1% |
| CVE-2023-4723 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 v | medium | 5.3 | 1% |
| CVE-2025-2807 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missi | high | 8.8 | 1% |
| CVE-2021-24639 | omgf (WordPress plugin) | The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX actio | high | 8.1 | 1% |
| CVE-2024-3895 | wp-datepicker (WordPress plugin) | The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_ | high | 8.8 | 1% |
| CVE-2024-0593 | simple-job-board (WordPress plugin) | The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fe | medium | 5.3 | 1% |
| CVE-2023-5877 | affiliate-toolkit (WordPress plugin) | The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/to | critical | 9.8 | 1% |
| CVE-2024-1991 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privileg | high | 8.8 | 1% |
| CVE-2021-24164 | ninja-forms (WordPress plugin) | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ | medium | 4.3 | 1% |
| CVE-2021-4331 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2. | high | 8.8 | 1% |
| CVE-2021-4359 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18 | medium | 6.5 | 1% |
| CVE-2023-3714 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group | high | 7.5 | 1% |
| CVE-2019-10187 | moodle/moodle | Moodle Ability to delete glossary entries that belong to another glossary | medium | 4.3 | 1% |
| CVE-2024-9756 | order-attachments-for-woocommerce (WordPress plugin) | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing cap | medium | 4.3 | 1% |
| CVE-2024-8480 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil | high | 8.8 | 1% |
| CVE-2020-36697 | wp-gdpr (WordPress plugin) | The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2 | high | 7.3 | 1% |
| CVE-2022-2108 | review-buddypress-groups (WordPress plugin) | The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due | medium | 6.5 | 1% |
| CVE-2019-25217 | speed-optimizer (WordPress plugin) | The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusio | critical | 9.8 | 1% |
| CVE-2020-36716 | wp-activity-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function | high | 7.3 | 1% |
| CVE-2024-1982 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the | medium | 6.5 | 1% |
| CVE-2024-10800 | user-extra-fields (WordPress plugin) | The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_sav | high | 8.8 | 1% |
| CVE-2019-25139 | coming-soon-page-\&-maintenance-mode (WordPress plugin) | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and includin | medium | 6.5 | 1% |
| CVE-2018-25105 | wp-file-manager (WordPress plugin) | The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in | critical | 9.8 | 1% |
| CVE-2024-5637 | market-exporter (WordPress plugin) | The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' | high | 7.5 | 1% |
| CVE-2024-3213 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o | medium | 5.3 | 1% |
| CVE-2021-4355 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdeta | high | 7.5 | 1% |
| CVE-2023-3713 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_ma | high | 8.8 | 1% |
| CVE-2022-0745 | like-button-rating (WordPress plugin) | The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipi | medium | 6.5 | 1% |
| CVE-2021-4369 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. Th | medium | 5.8 | 1% |
| CVE-2021-4379 | woocommerce-multi-currency (WordPress plugin) | The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_ | medium | 6.5 | 1% |
| CVE-2020-36720 | kali-forms (WordPress plugin) | The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to th | high | 7.1 | 1% |
| CVE-2024-0869 | instant-images (WordPress plugin) | The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized | high | 8.8 | 1% |
| CVE-2021-4383 | wp-quick-front-end-editor (WordPress plugin) | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due | high | 8.1 | 1% |
| CVE-2022-36340 | mailoptin (WordPress plugin) | Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress. | medium | 6.5 | 1% |
| CVE-2018-20155 | wp-maintenance-mode (WordPress plugin) | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restriction | medium | 4.3 | 1% |
| CVE-2020-12698 | directmailteam/direct-mail | Missing Authorization in TYPO3 extension | medium | 4.3 | 1% |
| CVE-2020-12700 | directmailteam/direct-mail | Missing Authorization in TYPO3 extension | medium | 4.3 | 1% |
| CVE-2022-0287 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing an | medium | 4.3 | 1% |
| CVE-2024-7258 | wp-product-feed-manager (WordPress plugin) | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | high | 8.8 | 1% |
| CVE-2024-11816 | wpextended (WordPress plugin) | The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a | high | 8.8 | 1% |
| CVE-2021-32472 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2020-36699 | quick-page\/post-redirect (WordPress plugin) | The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_qu | medium | 4.3 | 1% |
| CVE-2024-0780 | enjoy-social-feed (WordPress plugin) | The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation when resetting its database, a | high | 8.8 | 1% |