Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1323 | discy (WordPress plugin) | The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing | medium | 6.5 | 1% |
| CVE-2023-4645 | ad-inserter (WordPress plugin) | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax funct | medium | 5.3 | 1% |
| CVE-2023-5132 | soisy-pagamento-rateale (WordPress plugin) | The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parse | high | 7.5 | 1% |
| CVE-2025-14155 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data | medium | 5.3 | 1% |
| CVE-2023-0402 | social-warfare (WordPress plugin) | The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in v | medium | 5.4 | 1% |
| CVE-2023-5949 | smartcrawl (WordPress plugin) | The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content. | high | 7.5 | 1% |
| CVE-2024-4875 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a mi | medium | 4.3 | 1% |
| CVE-2022-3961 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system | medium | 6.5 | 1% |
| CVE-2022-4501 | mega-addons-for-visual-composer (WordPress plugin) | The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function | high | 7.1 | 1% |
| CVE-2023-4374 | wp-remote-users-sync (WordPress plugin) | The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability | medium | 4.3 | 1% |
| CVE-2021-32477 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2022-2369 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber | medium | 4.3 | 1% |
| CVE-2020-36712 | kali-forms (WordPress plugin) | The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This i | high | 8.6 | 1% |
| CVE-2023-5454 | templately (WordPress plugin) | The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticate | high | 7.5 | 1% |
| CVE-2025-3604 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2. | critical | 9.8 | 1% |
| CVE-2023-3125 | b2bking (WordPress plugin) | The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bking_save_p | medium | 6.5 | 1% |
| CVE-2021-4345 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole:: | medium | 6.5 | 1% |
| CVE-2021-4388 | opal-estate (WordPress plugin) | The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due | medium | 4.3 | 1% |
| CVE-2024-11205 | wpforms-lite (WordPress plugin) | The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_adm | high | 8.5 | 1% |
| CVE-2024-1170 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | high | 8.2 | 1% |
| CVE-2022-4935 | wc-multivendor-marketplace (WordPress plugin) | The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3. | high | 8.8 | 1% |
| CVE-2021-24842 | bulk-datetime-change (WordPress plugin) | The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) lis | medium | 5.4 | 1% |
| CVE-2022-48367 | ezsystems/ezpublish-kernel | Object state limitation has no effect | critical | 9.8 | 1% |
| CVE-2021-4089 | snipe/snipe-it | snipe-it is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2021-24355 | simple-301-redirects (WordPress plugin) | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the | medium | 4.3 | 1% |
| CVE-2024-1934 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | high | 7.5 | 1% |
| CVE-2022-4555 | wp-shamsi (WordPress plugin) | The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hook | medium | 6.5 | 1% |
| CVE-2020-36729 | 2j-slideshow (WordPress plugin) | The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' | medium | 5.4 | 1% |
| CVE-2023-2545 | feather-login-page (WordPress plugin) | The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOf | high | 8.1 | 1% |
| CVE-2022-3400 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action i | medium | 6.5 | 1% |
| CVE-2024-4444 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4. | medium | 5.3 | 1% |
| CVE-2023-1865 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin set | medium | 6.5 | 1% |
| CVE-2019-25143 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_c | medium | 5.4 | 1% |
| CVE-2021-4353 | woocommerce-dynamic-pricing-\&-discounts (WordPress plugin) | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and i | medium | 5.3 | 1% |
| CVE-2022-22107 | bottelet/flarepoint | Missing Authorization in DayByDay CRM | medium | 4.3 | 1% |
| CVE-2022-22108 | bottelet/flarepoint | Missing Authorization in DayByDay CRM | medium | 4.3 | 1% |
| CVE-2024-11104 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plu | high | 8.1 | 1% |
| CVE-2021-4364 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add | medium | 4.3 | 1% |
| CVE-2023-2415 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 5.4 | 1% |
| CVE-2021-34629 | sendgrid (WordPress plugin) | The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/lib/class-sendgrid-s | medium | 4.3 | 1% |
| CVE-2020-36715 | easy-login-woocommerce (WordPress plugin) | The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in v | high | 7.4 | 1% |
| CVE-2023-0958 | backup-migration (WordPress plugin), clone (WordPress plugin), duplicate-post (WordPress plugin) +8 more | Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the hand | medium | 4.3 | 1% |
| CVE-2023-3126 | b2bking (WordPress plugin) | The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadprice | medium | 4.3 | 1% |
| CVE-2025-5304 | project-notebooks (WordPress plugin) | The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_a | critical | 9.8 | 1% |
| CVE-2024-1710 | addon-library (WordPress plugin) | The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction fu | high | 8.8 | 1% |
| CVE-2024-1072 | coming-soon (WordPress plugin) | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable | high | 8.2 | 1% |
| CVE-2021-4351 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. Thi | medium | 5.8 | 1% |
| CVE-2023-0619 | kraken-image-optimizer (WordPress plugin) | The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actio | medium | 6.5 | 1% |
| CVE-2026-8236 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR combined with a missing authentication gate | medium | 0.0 | 1% |
| CVE-2024-0377 | lifterlms (WordPress plugin) | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 1% |