Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8123 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t | medium | 5.4 | 0% |
| CVE-2024-10695 | futurio-extra (WordPress plugin) | The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor | medium | 4.3 | 0% |
| CVE-2024-12062 | charity-addon-for-elementor (WordPress plugin) | The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.3 via t | medium | 4.3 | 0% |
| CVE-2025-10039 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio | medium | 4.3 | 0% |
| CVE-2024-2346 | filebird (WordPress plugin) | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all | medium | 5.4 | 0% |
| CVE-2024-10693 | skt-addons-for-elementor (WordPress plugin) | The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.3 via the Un | medium | 4.3 | 0% |
| CVE-2024-10770 | envo-extra (WordPress plugin) | The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-tem | medium | 4.3 | 0% |
| CVE-2024-12059 | elementinvader-addons-for-elementor (WordPress plugin) | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl | medium | 4.3 | 0% |
| CVE-2026-31820 | sylius/sylius | Sylius affected by IDOR in Cart and Checkout LiveComponents | high | 0.0 | 0% |
| CVE-2022-2312 | student-result-or-employee-database (WordPress plugin) | The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make log | medium | 5.4 | 0% |
| CVE-2026-33759 | wwbn/avideo | AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents | medium | 5.3 | 0% |
| CVE-2024-48899 | moodle/moodle | Moodle IDOR when accessing list of course badges | medium | 4.3 | 0% |
| CVE-2026-21447 | bagisto/bagisto | Bagisto has IDOR in Customer Order Reorder Functionality | high | 7.1 | 0% |
| CVE-2026-47230 | admidio/admidio | Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders | medium | 6.5 | 0% |
| CVE-2026-48067 | filament/actions, filament/tables | Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields | medium | 6.5 | 0% |
| CVE-2024-45232 | in2code/powermail | "powermail" (powermail) Insecure Direct Object Reference (IDOR) | high | 7.3 | 0% |
| CVE-2025-48202 | in2code/femanager | The femanager TYPO3 extension allows Insecure Direct Object Reference | medium | 5.3 | 0% |
| CVE-2025-66306 | getgrav/grav | Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel | medium | 4.3 | 0% |
| CVE-2026-31867 | craftcms/commerce | Craft Commerce: Potential IDOR in Commerce carts | medium | 0.0 | 0% |
| CVE-2026-55478 | snipe/snipe-it | Snipe-IT has missing object-level authorization in Kits API | medium | 0.0 | 0% |
| CVE-2024-38874 | jweiland/events2 | events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability | medium | 5.4 | 0% |
| CVE-2026-29069 | craftcms/cms | Craft CMS has unauthenticated activation email trigger with potential user enumeration | high | 0.0 | 0% |
| CVE-2026-55694 | snipe/snipe-it | Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover | high | 0.0 | 0% |
| CVE-2026-7886 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage | low | 0.0 | 0% |
| CVE-2024-13740 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio | medium | 4.3 | 0% |
| CVE-2025-0661 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the d | medium | 4.3 | 0% |
| CVE-2025-3282 | user-registration (WordPress plugin) | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure D | medium | 5.3 | 0% |
| CVE-2024-13407 | omnipress (WordPress plugin) | The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block | medium | 4.3 | 0% |
| CVE-2026-40907 | wwbn/avideo | WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens | medium | 6.5 | 0% |
| CVE-2026-30927 | admidio/admidio | Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter | medium | 0.0 | 0% |
| CVE-2026-4208 | ralffreit/mfa-email | Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email) | high | 8.8 | 0% |
| CVE-2026-80197 | kimai/kimai | Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation | low | 0.0 | 0% |
| CVE-2026-44692 | code16/sharp | Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint | high | 7.7 | 0% |
| CVE-2025-7900 | in2code/femanager | Femanager extension for TYPO3 allows Insecure Direct Object Reference | medium | 0.0 | 0% |
| CVE-2026-28782 | craftcms/cms | Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action | medium | 0.0 | 0% |
| CVE-2026-8347 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog | low | 0.0 | 0% |
| CVE-2026-54256 | winter/wn-backend-module | Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata | medium | 5.4 | 0% |
| CVE-2025-1327 | homey (WordPress theme) | The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_d | medium | 4.3 | 0% |
| CVE-2026-53675 | buddypress/buddypress | BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR | medium | 4.3 | 0% |
| CVE-2026-33764 | wwbn/avideo | AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions | medium | 4.3 | 0% |
| CVE-2026-8204 | concrete5/concrete5 | Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog | medium | 5.3 | 0% |
| CVE-2026-52841 | alextselegidis/easyappointments | Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync | low | 3.1 | 0% |
| CVE-2026-7881 | concrete5/concrete5 | Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block | medium | 0.0 | 0% |
| CVE-2026-43883 | wwbn/avideo | AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements | medium | 4.2 | 0% |
| CVE-2026-107850 | contao/core-bundle | Contao: Improper access control in the preview links module | medium | 4.3 | 0% |
| CVE-2025-24856 | causal/oidc | TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) | medium | 4.2 | 0% |
| CVE-2026-52839 | alextselegidis/easyappointments | Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass | low | 3.3 | 0% |
| GHSA-rm67-g9ch-vxff | poweradmin/poweradmin | Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own | high | 8.1 | – |
| GHSA-g4hp-pfvf-vm5w | silverstripe/framework | SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation | medium | 6.5 | – |
| GHSA-mpmw-f6h6-3g26 | winter/wn-backend-module | Winter: My Account preview exposes another backend user's profile by record ID | medium | 4.3 | – |