Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9546 | wpide (WordPress plugin) | The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4. | medium | 5.3 | 1% |
| CVE-2022-36399 | booked (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendar | medium | 5.3 | 1% |
| CVE-2026-49211 | symfony/ux-autocomplete | symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil | medium | 0.0 | 1% |
| CVE-2024-45792 | mantisbt/mantisbt | MantisBT vulnerable to information disclosure with user profiles | medium | 4.3 | 1% |
| CVE-2024-8979 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | high | 8.0 | 1% |
| CVE-2024-34717 | prestashop/prestashop | Anonymous PrestaShop customer can download other customers' invoices | medium | 5.3 | 1% |
| CVE-2024-6835 | add-search-to-menu (WordPress plugin) | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, | medium | 5.3 | 1% |
| CVE-2025-32044 | moodle/moodle | Moodle allows unauthenticated REST API user data exposure | high | 7.5 | 1% |
| CVE-2024-2931 | wpfront-user-role-editor (WordPress plugin) | The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2. | medium | 4.3 | 1% |
| CVE-2024-12255 | accept-stripe-payments-using-contact-form-7 (WordPress plugin) | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |
| CVE-2023-5134 | easy-registration-forms (WordPress plugin) | The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, a | medium | 4.3 | 1% |
| CVE-2024-13622 | woo-addon-uploads (WordPress plugin) | The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | high | 7.5 | 1% |
| CVE-2023-48288 | jobwp (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.Thi | high | 7.5 | 1% |
| CVE-2026-50157 | auth0/symfony | Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter | medium | 6.5 | 1% |
| CVE-2024-2950 | boldgrid-easy-seo (WordPress plugin) | The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inclu | medium | 5.3 | 1% |
| CVE-2024-13600 | majestic-support (WordPress plugin) | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Expo | high | 7.5 | 0% |
| CVE-2024-13611 | bp-better-messages (WordPress plugin) | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitiv | high | 7.5 | 0% |
| CVE-2024-25121 | typo3/cms-core | TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler | high | 7.1 | 0% |
| CVE-2024-2974 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Se | medium | 5.3 | 0% |
| CVE-2024-3733 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Se | medium | 5.3 | 0% |
| CVE-2022-46158 | prestashop/prestashop | PrestaShop has potential Information exposure in the upload directory | medium | 5.3 | 0% |
| CVE-2024-7418 | the-post-grid (WordPress plugin) | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Sensitive Informatio | medium | 4.3 | 0% |
| CVE-2023-6922 | coming-soon-maintenance-mode-from-acurax (WordPress plugin) | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to | medium | 4.3 | 0% |
| CVE-2026-79773 | winter/wn-system-module | Winter: Local File Inclusion through =include directives in JavaScript asset compilation | medium | 4.9 | 0% |
| CVE-2024-2966 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 5.3 | 0% |
| CVE-2024-8978 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 5.7 | 0% |
| CVE-2024-13613 | wise-chat (WordPress plugin) | The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uplo | high | 7.5 | 0% |
| CVE-2024-10050 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6 | medium | 4.3 | 0% |
| CVE-2024-41109 | pimcore/admin-ui-classic-bundle | Pimcore vulnerable to disclosure of system and database information behind /admin firewall | medium | 6.3 | 0% |
| CVE-2024-0616 | content-protector (WordPress plugin) | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to | medium | 5.3 | 0% |
| CVE-2024-0620 | password-protect-page (WordPress plugin) | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 0% |
| CVE-2024-7412 | no-update-nag (WordPress plugin) | The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to th | medium | 5.3 | 0% |
| CVE-2023-51406 | fastdup (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.Th | medium | 5.3 | 0% |
| CVE-2023-51688 | ecommerce-product-catalog (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This is | medium | 5.3 | 0% |
| CVE-2024-11291 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to S | medium | 5.3 | 0% |
| CVE-2024-7630 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Fr | medium | 5.3 | 0% |
| CVE-2026-1196 | mineadmin/mineadmin | MineAdmin May Expose Sensitive Information to an Unauthorized Actor | low | 3.1 | 0% |
| CVE-2024-34002 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 6.5 | 0% |
| CVE-2024-34005 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 6.5 | 0% |
| CVE-2024-13638 | order-attachments-for-woocommerce (WordPress plugin) | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.9 | 0% |
| CVE-2024-13641 | woo-refund-and-exchange-lite (WordPress plugin) | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPre | medium | 5.9 | 0% |
| CVE-2024-50342 | symfony/http-client, symfony/symfony | Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient | low | 3.1 | 0% |
| CVE-2024-34358 | typo3/cms-core | TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController | medium | 5.3 | 0% |
| CVE-2024-0906 | fx-private-site (WordPress plugin) | The f(x) Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via t | medium | 5.3 | 0% |
| CVE-2026-2894 | funadmin/funadmin | funadmin exposes sensitive information via getMember function | medium | 5.3 | 0% |
| CVE-2025-1322 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-8106 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 6.5 | 0% |
| CVE-2026-56341 | wwbn/avideo | AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records | high | 7.5 | 0% |
| CVE-2024-34004 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 6.5 | 0% |
| CVE-2026-52837 | alextselegidis/easyappointments | Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page | medium | 0.0 | 0% |