Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1176 | ht-easy-google-analytics (WordPress plugin) | The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 1% |
| CVE-2021-4375 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_sy | medium | 4.3 | 1% |
| CVE-2024-9941 | wordpress-gym-management-system (WordPress plugin) | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on | high | 8.8 | 1% |
| CVE-2021-4376 | woo-multi-currency (WordPress plugin) | The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This m | medium | 4.3 | 1% |
| CVE-2023-2280 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability ch | medium | 6.5 | 1% |
| CVE-2022-2543 | visual-portfolio\,-photo-gallery-\&-post-grid (WordPress plugin) | The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST | medium | 6.1 | 1% |
| CVE-2023-0712 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object func | medium | 5.4 | 1% |
| CVE-2023-0719 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order | medium | 5.4 | 1% |
| CVE-2022-38057 | th-advance-product-search (WordPress plugin) | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/ | medium | 6.5 | 1% |
| CVE-2023-0555 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions i | high | 8.1 | 1% |
| CVE-2022-2696 | menu-ordering-reservations (WordPress plugin) | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX a | medium | 6.3 | 1% |
| CVE-2024-1387 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the du | medium | 4.3 | 1% |
| CVE-2023-2189 | stax-addons-for-elementor (WordPress plugin) | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 1% |
| CVE-2023-0293 | mediamatic (WordPress plugin) | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its A | medium | 4.3 | 1% |
| CVE-2024-0907 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 5.3 | 1% |
| CVE-2024-1129 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 5.3 | 1% |
| CVE-2024-1130 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 5.3 | 1% |
| CVE-2023-4304 | froxlor/froxlor | Froxlor vulnerable to business logic errors | low | 3.8 | 1% |
| CVE-2022-3622 | blog2social (WordPress plugin) | The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and includin | medium | 4.1 | 1% |
| CVE-2021-25014 | ibtana (WordPress plugin) | The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowin | low | 3.5 | 1% |
| CVE-2023-0718 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder func | medium | 5.4 | 1% |
| CVE-2023-6821 | error-log-viewer (WordPress plugin) | The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and downl | medium | 6.5 | 1% |
| CVE-2022-0178 | snipe/snipe-it | Improper Access Control in snipe-it | medium | 5.4 | 1% |
| CVE-2024-13556 | affiliate-links (WordPress plugin) | The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in al | high | 8.1 | 1% |
| CVE-2023-0447 | youtube-channel (WordPress plugin) | The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache f | medium | 4.3 | 1% |
| CVE-2024-12269 | safe-ai-malware-protection-for-wp (WordPress plugin) | The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on | high | 7.5 | 1% |
| CVE-2021-24890 | scripts-organizer (WordPress plugin) | The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both | high | 8.8 | 1% |
| CVE-2024-1169 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | high | 7.5 | 1% |
| CVE-2024-0447 | artibot (WordPress plugin) | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 5.0 | 1% |
| CVE-2023-22489 | flarum/core | Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted | low | 3.5 | 1% |
| CVE-2026-52766 | yeswiki/yeswiki | YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action | critical | 9.1 | 1% |
| CVE-2023-5905 | export-posts-with-images (WordPress plugin) | The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export | high | 8.1 | 1% |
| CVE-2024-1587 | newsmatic (WordPress theme) | The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsm | medium | 5.3 | 1% |
| CVE-2024-3601 | poll-maker (WordPress plugin) | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch | medium | 5.3 | 1% |
| CVE-2024-10528 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 4.3 | 1% |
| CVE-2024-12822 | media-manager (WordPress plugin) | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation | critical | 9.8 | 1% |
| CVE-2024-10393 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a mi | medium | 5.3 | 1% |
| CVE-2024-0385 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 1% |
| CVE-2024-10813 | woo-product-table (WordPress plugin) | The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposur | medium | 5.3 | 1% |
| CVE-2023-0684 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders | medium | 5.4 | 1% |
| CVE-2023-0711 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state funct | medium | 5.4 | 1% |
| CVE-2023-0713 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder funct | medium | 5.4 | 1% |
| CVE-2023-0715 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder fun | medium | 5.4 | 1% |
| CVE-2023-0716 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder func | medium | 5.4 | 1% |
| CVE-2023-0717 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder fu | medium | 5.4 | 1% |
| CVE-2023-0720 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_orde | medium | 5.4 | 1% |
| CVE-2023-1026 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory | medium | 4.3 | 1% |
| CVE-2026-82394 | sulu/sulu | Sulu: Fix authorization bypass when creating preview links | medium | 0.0 | 1% |
| CVE-2021-24779 | wp-debugging (WordPress plugin) | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and | medium | 6.5 | 1% |
| CVE-2023-3403 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_ | medium | 5.4 | 1% |