Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-0965 | simple-page-access-restriction (WordPress plugin) | The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including | medium | 5.3 | 0% |
| CVE-2024-0969 | armember-membership (WordPress plugin) | The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST | medium | 5.3 | 0% |
| CVE-2024-38909 | studio-42/elfinder | Studio 42 elFinder vulnerable to Incorrect Access Control | critical | 9.8 | 0% |
| CVE-2024-45149 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | low | 2.7 | 0% |
| CVE-2023-5542 | moodle/moodle | Moodle Improper Access Control vulnerability | medium | 4.3 | 0% |
| CVE-2025-27206 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control leads to security feature bypass | medium | 5.3 | 0% |
| CVE-2024-0978 | jonradio-private-site (WordPress plugin) | The My Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.14 via th | medium | 5.3 | 0% |
| CVE-2024-1472 | wp-maintenance (WordPress plugin) | The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. | medium | 5.3 | 0% |
| CVE-2024-1475 | coming-soon-maintenance-mode (WordPress plugin) | The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 0% |
| CVE-2026-24420 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) | medium | 6.5 | 0% |
| CVE-2024-0766 | envo-elementor-for-woocommerce (WordPress plugin) | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi | medium | 4.3 | 0% |
| CVE-2026-46337 | wwbn/avideo | AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` | medium | 5.3 | 0% |
| CVE-2024-13229 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing c | medium | 4.3 | 0% |
| CVE-2024-1492 | wpify-woo (WordPress plugin) | The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to | medium | 5.3 | 0% |
| CVE-2021-24801 | wp-survey-plus (WordPress plugin) | The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any u | medium | 4.3 | 0% |
| CVE-2024-1092 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unaut | medium | 4.3 | 0% |
| CVE-2025-24437 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 5.4 | 0% |
| CVE-2023-2104 | alextselegidis/easyappointments | alextselegidis/easyappointments Improper Access Control vulnerability | medium | 5.4 | 0% |
| CVE-2021-24853 | qr-redirector (WordPress plugin) | The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_sa | medium | 4.3 | 0% |
| CVE-2024-1370 | maintenance-page (WordPress plugin) | The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_do | medium | 5.3 | 0% |
| CVE-2023-3700 | alextselegidis/easyappointments | Easy!Appointments Improper Access Control vulnerability | medium | 6.3 | 0% |
| CVE-2024-0972 | buddypress-members-only (WordPress plugin) | The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 | medium | 5.3 | 0% |
| CVE-2025-55741 | unopim/unopim | UnoPim has Broken Access Control | high | 8.1 | 0% |
| CVE-2024-39414 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control Leads to Privilege escalation | medium | 4.3 | 0% |
| CVE-2023-6733 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 6.5 | 0% |
| CVE-2024-1584 | wp-analytify (WordPress plugin) | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized modifi | medium | 5.3 | 0% |
| CVE-2021-24688 | orange-form (WordPress plugin) | The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_ | medium | 4.3 | 0% |
| CVE-2024-1288 | schema-\&-structured-data-for-wp-\&-amp (WordPress plugin) | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2024-42354 | shopware/core, shopware/platform | Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api | medium | 5.3 | 0% |
| CVE-2026-34390 | mantisbt/mantisbt | MantisBT Vulnerable to Privilege Escalation from Manager to Administrator | medium | 0.0 | 0% |
| CVE-2024-38273 | moodle/moodle | Moodle BigBlueButton web service leaks meeting joining information | medium | 4.3 | 0% |
| CVE-2024-0369 | bulk-edit-post-titles (WordPress plugin) | The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b | medium | 4.3 | 0% |
| CVE-2024-0370 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-0371 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2021-24752 | catch-scroll-progress-bar (WordPress plugin), catch-sticky-menu (WordPress plugin), catch-themes-demo-import (WordPress plugin) +7 more | Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any | medium | 5.7 | 0% |
| CVE-2023-47110 | prestashop/blockreassurance | Any value can be changed in the configuration table by an employee having access to block reassurance module | medium | 5.3 | 0% |
| CVE-2025-59943 | thorsten/phpmyfaq | phpMyFAQ duplicate email registration allows multiple accounts with the same email | high | 8.1 | 0% |
| CVE-2023-3303 | admidio/admidio | Admidio Improper Access Control vulnerability | low | 3.5 | 0% |
| CVE-2023-3304 | admidio/admidio | Admidio Improper Access Control vulnerability | medium | 5.4 | 0% |
| CVE-2024-1044 | customer-reviews-for-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che | medium | 5.3 | 0% |
| CVE-2025-67510 | neuron-core/neuron-ai | Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”) | critical | 9.4 | 0% |
| CVE-2026-50280 | craftcms/cms | Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check | medium | 0.0 | 0% |
| CVE-2024-22407 | shopware/core, shopware/platform | Broken Access Control order API in Shopware | medium | 4.9 | 0% |
| CVE-2026-22692 | october/rain | October Rain has a Twig Sandbox Bypass via Collection Methods | medium | 4.9 | 0% |
| CVE-2023-6966 | the-moneytizer (WordPress plugin) | The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missin | high | 8.1 | 0% |
| CVE-2023-5976 | microweber/microweber | Microweber Improper Access Control vulnerability | medium | 4.3 | 0% |
| CVE-2024-1053 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th | medium | 4.3 | 0% |
| CVE-2022-47407 | fixpunkt/fp-masterquiz | TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz) | medium | 6.5 | 0% |
| CVE-2024-0451 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_c | medium | 5.0 | 0% |
| CVE-2024-8269 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all v | high | 7.3 | 0% |