Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0731 | dolibarr/dolibarr | Improper Authorization in dolibarr/dolibarr | medium | 6.5 | 1% |
| CVE-2021-4357 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on t | critical | 9.1 | 1% |
| CVE-2022-1203 | content-mask (WordPress plugin) | The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not va | medium | 4.3 | 1% |
| CVE-2023-0335 | wp-shamsi (WordPress plugin) | The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscri | medium | 6.5 | 1% |
| CVE-2023-0336 | ooohboi-steroids-for-elementor (WordPress plugin) | The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with ro | medium | 6.5 | 1% |
| CVE-2022-0163 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any | medium | 6.5 | 1% |
| CVE-2021-37517 | dolibarr/dolibarr | Access Control vulnerability in Dolibarr | high | 7.5 | 1% |
| CVE-2021-24379 | comments-like-dislike (WordPress plugin) | The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from rep | medium | 5.3 | 1% |
| CVE-2023-38209 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 6.5 | 1% |
| CVE-2020-36721 | activello (WordPress plugin), affluent (WordPress plugin), allegiant (WordPress plugin) +12 more | The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. | medium | 6.5 | 1% |
| CVE-2019-19984 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plug | medium | 6.3 | 1% |
| CVE-2023-3956 | instawp-connect (WordPress plugin) | The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missin | critical | 9.8 | 1% |
| CVE-2020-9514 | idx-broker-platinum (WordPress plugin) | An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subs | medium | 6.5 | 1% |
| CVE-2023-2448 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_te | medium | 6.5 | 1% |
| CVE-2023-0556 | contentstudio (WordPress plugin) | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versi | critical | 9.8 | 1% |
| CVE-2021-4339 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.ph | high | 7.5 | 1% |
| CVE-2021-24851 | insert-pages (WordPress plugin) | The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary | medium | 4.3 | 1% |
| CVE-2021-24244 | wpbakery-page-builder-clipboard (WordPress plugin) | An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability che | medium | 6.5 | 1% |
| CVE-2022-2370 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the setting | medium | 6.5 | 1% |
| CVE-2020-25781 | mantisbt/mantisbt | MantisBT unauthorized users able to access private files | medium | 4.3 | 1% |
| CVE-2024-11270 | wp-webinarsystem (WordPress plugin) | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check | high | 8.8 | 1% |
| CVE-2023-3244 | comments-like-dislike (WordPress plugin) | The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the r | medium | 4.3 | 1% |
| CVE-2023-3459 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | high | 7.2 | 1% |
| CVE-2021-4026 | ssddanbrown/bookstack | bookstack is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2023-38488 | getkirby/cms | Field injection in the KirbyData text storage handler | high | 7.1 | 1% |
| CVE-2023-4723 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 v | medium | 5.3 | 1% |
| CVE-2019-3848 | moodle/moodle | Moodle Logged in users could view all calendar events | medium | 4.3 | 1% |
| CVE-2025-2807 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missi | high | 8.8 | 1% |
| CVE-2021-24639 | omgf (WordPress plugin) | The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX actio | high | 8.1 | 1% |
| CVE-2024-3895 | wp-datepicker (WordPress plugin) | The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_ | high | 8.8 | 1% |
| CVE-2024-0593 | simple-job-board (WordPress plugin) | The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fe | medium | 5.3 | 1% |
| CVE-2020-29605 | mantisbt/mantisbt | MantisBT Incorrect Authorization in bug_actiongroup_page.php | medium | 0.0 | 1% |
| CVE-2021-24788 | batch-cat (WordPress plugin) | The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. | medium | 6.5 | 1% |
| CVE-2023-5877 | affiliate-toolkit (WordPress plugin) | The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/to | critical | 9.8 | 1% |
| CVE-2024-1991 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privileg | high | 8.8 | 1% |
| CVE-2021-24164 | ninja-forms (WordPress plugin) | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ | medium | 4.3 | 1% |
| CVE-2021-4331 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2. | high | 8.8 | 1% |
| CVE-2023-38218 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | high | 8.8 | 1% |
| CVE-2021-4359 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18 | medium | 6.5 | 1% |
| CVE-2023-3714 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group | high | 7.5 | 1% |
| CVE-2019-10187 | moodle/moodle | Moodle Ability to delete glossary entries that belong to another glossary | medium | 4.3 | 1% |
| CVE-2024-9756 | order-attachments-for-woocommerce (WordPress plugin) | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing cap | medium | 4.3 | 1% |
| CVE-2021-24742 | logo-slider-and-showcase (WordPress plugin) | The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX a | medium | 6.5 | 1% |
| CVE-2024-8480 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil | high | 8.8 | 1% |
| CVE-2021-24770 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to | medium | 6.5 | 1% |
| CVE-2020-36697 | wp-gdpr (WordPress plugin) | The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2 | high | 7.3 | 1% |
| CVE-2022-2108 | review-buddypress-groups (WordPress plugin) | The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due | medium | 6.5 | 1% |
| CVE-2019-25217 | speed-optimizer (WordPress plugin) | The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusio | critical | 9.8 | 1% |
| CVE-2020-15513 | mittwald/typo3_forum | Incorrect access control in typo3_forum | medium | 5.3 | 1% |
| CVE-2021-4352 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsetti | medium | 5.3 | 1% |