Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-34106 | magento/community-edition | Magento Open Source Incorrect Authorization vulnerability | medium | 5.3 | 1% |
| CVE-2022-35692 | magento/community-edition, magento/project-community-edition | Magento Open Source has Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2021-24279 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug A | medium | 6.5 | 1% |
| CVE-2020-36716 | wp-activity-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function | high | 7.3 | 1% |
| CVE-2024-1982 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the | medium | 6.5 | 1% |
| CVE-2021-24783 | post-expirator (WordPress plugin) | The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low | medium | 6.5 | 1% |
| CVE-2021-28567 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability in the customers module | medium | 5.0 | 1% |
| CVE-2020-25025 | localizationteam/l10nmgr | Incorrect Authorization in TYPO3 extension | medium | 4.3 | 1% |
| CVE-2023-0940 | profilegrid (WordPress plugin) | The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authoriz | high | 8.8 | 1% |
| CVE-2024-10800 | user-extra-fields (WordPress plugin) | The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_sav | high | 8.8 | 1% |
| CVE-2019-25139 | coming-soon-page-\&-maintenance-mode (WordPress plugin) | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and includin | medium | 6.5 | 1% |
| CVE-2021-28661 | silverstripe/graphql | SilverStripe GraphQL Server permission checker not inherited by query subclass. | medium | 4.3 | 1% |
| CVE-2018-25105 | wp-file-manager (WordPress plugin) | The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in | critical | 9.8 | 1% |
| CVE-2024-5637 | market-exporter (WordPress plugin) | The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' | high | 7.5 | 1% |
| CVE-2024-3213 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o | medium | 5.3 | 1% |
| CVE-2021-24819 | page\/post-content-shortcode (WordPress plugin) | The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low | medium | 4.3 | 1% |
| CVE-2021-4355 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdeta | high | 7.5 | 1% |
| CVE-2020-13676 | drupal/core | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclo | medium | 6.5 | 1% |
| CVE-2023-3713 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_ma | high | 8.8 | 1% |
| CVE-2022-0745 | like-button-rating (WordPress plugin) | The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipi | medium | 6.5 | 1% |
| CVE-2023-0328 | wpcode (WordPress plugin) | The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. | medium | 4.3 | 1% |
| CVE-2022-0825 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update oth | medium | 5.4 | 1% |
| CVE-2021-4369 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. Th | medium | 5.8 | 1% |
| CVE-2021-4379 | woocommerce-multi-currency (WordPress plugin) | The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_ | medium | 6.5 | 1% |
| CVE-2021-24824 | custom-content-shortcode (WordPress plugin) | The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as lo | medium | 4.3 | 1% |
| CVE-2020-36720 | kali-forms (WordPress plugin) | The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to th | high | 7.1 | 1% |
| CVE-2024-0869 | instant-images (WordPress plugin) | The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized | high | 8.8 | 1% |
| CVE-2021-4383 | wp-quick-front-end-editor (WordPress plugin) | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due | high | 8.1 | 1% |
| CVE-2021-24733 | wp-post-page-clone (WordPress plugin) | The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and p | medium | 4.3 | 1% |
| CVE-2022-36340 | mailoptin (WordPress plugin) | Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress. | medium | 6.5 | 1% |
| CVE-2018-20155 | wp-maintenance-mode (WordPress plugin) | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restriction | medium | 4.3 | 1% |
| CVE-2020-12698 | directmailteam/direct-mail | Missing Authorization in TYPO3 extension | medium | 4.3 | 1% |
| CVE-2020-12700 | directmailteam/direct-mail | Missing Authorization in TYPO3 extension | medium | 4.3 | 1% |
| CVE-2022-0287 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing an | medium | 4.3 | 1% |
| CVE-2020-36710 | wps-hide-login (WordPress plugin) | The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the logi | medium | 5.3 | 1% |
| CVE-2024-7258 | wp-product-feed-manager (WordPress plugin) | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | high | 8.8 | 1% |
| CVE-2024-11816 | wpextended (WordPress plugin) | The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a | high | 8.8 | 1% |
| CVE-2021-32472 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2020-36699 | quick-page\/post-redirect (WordPress plugin) | The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_qu | medium | 4.3 | 1% |
| CVE-2024-0780 | enjoy-social-feed (WordPress plugin) | The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation when resetting its database, a | high | 8.8 | 1% |
| CVE-2021-24905 | advanced-cf7-db (WordPress plugin) | The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete | high | 8.0 | 1% |
| CVE-2020-25026 | derhansen/sf_event_mgt | Information Disclosure in TYPO3 extension sf_event_mgt | medium | 4.3 | 1% |
| CVE-2022-1323 | discy (WordPress plugin) | The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing | medium | 6.5 | 1% |
| CVE-2022-25270 | drupal/core | The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the " | medium | 6.5 | 1% |
| CVE-2023-0814 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the | medium | 6.5 | 1% |
| CVE-2023-4645 | ad-inserter (WordPress plugin) | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax funct | medium | 5.3 | 1% |
| CVE-2023-5132 | soisy-pagamento-rateale (WordPress plugin) | The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parse | high | 7.5 | 1% |
| CVE-2025-14155 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data | medium | 5.3 | 1% |
| CVE-2021-40616 | thinkcmf/thinkcmf | Incorrect Authorization in thinkcmf | medium | 6.5 | 1% |
| CVE-2022-24748 | shopware/core | Incorrect Authentication in shopware | medium | 6.8 | 1% |