Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0402 | social-warfare (WordPress plugin) | The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in v | medium | 5.4 | 1% |
| CVE-2023-5949 | smartcrawl (WordPress plugin) | The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content. | high | 7.5 | 1% |
| CVE-2024-4875 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a mi | medium | 4.3 | 1% |
| CVE-2022-3961 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system | medium | 6.5 | 1% |
| CVE-2022-4501 | mega-addons-for-visual-composer (WordPress plugin) | The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function | high | 7.1 | 1% |
| CVE-2024-22208 | phpmyfaq/phpmyfaq | phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes | medium | 6.5 | 1% |
| CVE-2024-47053 | mautic/core | Mautic allows Improper Authorization in Reporting API | high | 7.7 | 1% |
| CVE-2023-4374 | wp-remote-users-sync (WordPress plugin) | The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability | medium | 4.3 | 1% |
| CVE-2021-32477 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2022-2369 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber | medium | 4.3 | 1% |
| CVE-2020-36712 | kali-forms (WordPress plugin) | The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This i | high | 8.6 | 1% |
| CVE-2023-5454 | templately (WordPress plugin) | The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticate | high | 7.5 | 1% |
| CVE-2025-3604 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2. | critical | 9.8 | 1% |
| CVE-2023-3125 | b2bking (WordPress plugin) | The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bking_save_p | medium | 6.5 | 1% |
| CVE-2021-4345 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole:: | medium | 6.5 | 1% |
| CVE-2021-4388 | opal-estate (WordPress plugin) | The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due | medium | 4.3 | 1% |
| CVE-2024-11205 | wpforms-lite (WordPress plugin) | The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_adm | high | 8.5 | 1% |
| CVE-2021-24282 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJA | medium | 6.3 | 1% |
| CVE-2024-45132 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 6.5 | 1% |
| CVE-2024-1170 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | high | 8.2 | 1% |
| CVE-2022-4935 | wc-multivendor-marketplace (WordPress plugin) | The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3. | high | 8.8 | 1% |
| CVE-2021-24842 | bulk-datetime-change (WordPress plugin) | The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) lis | medium | 5.4 | 1% |
| CVE-2022-48367 | ezsystems/ezpublish-kernel | Object state limitation has no effect | critical | 9.8 | 1% |
| CVE-2021-4089 | snipe/snipe-it | snipe-it is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2021-24355 | simple-301-redirects (WordPress plugin) | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the | medium | 4.3 | 1% |
| CVE-2024-1934 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | high | 7.5 | 1% |
| CVE-2021-24652 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to pe | medium | 6.5 | 1% |
| CVE-2022-4555 | wp-shamsi (WordPress plugin) | The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hook | medium | 6.5 | 1% |
| CVE-2020-36729 | 2j-slideshow (WordPress plugin) | The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' | medium | 5.4 | 1% |
| CVE-2023-2545 | feather-login-page (WordPress plugin) | The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOf | high | 8.1 | 1% |
| CVE-2022-3400 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action i | medium | 6.5 | 1% |
| CVE-2024-4444 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4. | medium | 5.3 | 1% |
| CVE-2022-0334 | moodle/moodle | Insufficient user authorization in Moodle | medium | 4.3 | 1% |
| CVE-2021-4194 | ssddanbrown/bookstack | bookstack is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2023-1865 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin set | medium | 6.5 | 1% |
| CVE-2019-25143 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_c | medium | 5.4 | 1% |
| CVE-2021-4353 | woocommerce-dynamic-pricing-\&-discounts (WordPress plugin) | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and i | medium | 5.3 | 1% |
| CVE-2021-25954 | dolibarr/dolibarr | Improper Access Control in Dolibarr | medium | 4.3 | 1% |
| CVE-2022-22107 | bottelet/flarepoint | Missing Authorization in DayByDay CRM | medium | 4.3 | 1% |
| CVE-2022-22108 | bottelet/flarepoint | Missing Authorization in DayByDay CRM | medium | 4.3 | 1% |
| CVE-2024-11104 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plu | high | 8.1 | 1% |
| CVE-2021-4364 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add | medium | 4.3 | 1% |
| CVE-2023-2415 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 5.4 | 1% |
| CVE-2021-34629 | sendgrid (WordPress plugin) | The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/lib/class-sendgrid-s | medium | 4.3 | 1% |
| CVE-2020-36715 | easy-login-woocommerce (WordPress plugin) | The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in v | high | 7.4 | 1% |
| CVE-2022-47408 | fixpunkt/fp-newsletter | Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter) | critical | 9.1 | 1% |
| CVE-2023-46906 | juzaweb/cms | juzawebCMS Incorrect Access Control vulnerability | medium | 4.9 | 1% |
| CVE-2023-0958 | backup-migration (WordPress plugin), clone (WordPress plugin), duplicate-post (WordPress plugin) +8 more | Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the hand | medium | 4.3 | 1% |
| CVE-2021-24207 | wp-page-builder (WordPress plugin) | By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pa | medium | 4.3 | 1% |
| CVE-2023-3126 | b2bking (WordPress plugin) | The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadprice | medium | 4.3 | 1% |