Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-5304 | project-notebooks (WordPress plugin) | The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_a | critical | 9.8 | 1% |
| CVE-2024-1710 | addon-library (WordPress plugin) | The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction fu | high | 8.8 | 1% |
| CVE-2024-1072 | coming-soon (WordPress plugin) | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable | high | 8.2 | 1% |
| CVE-2025-24409 | magento/community-edition, magento/project-community-edition | Adobe Commerce Improper Authorization vulnerability | high | 8.2 | 1% |
| CVE-2024-25108 | pixelfed/pixelfed | Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions | critical | 9.9 | 1% |
| CVE-2021-4351 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. Thi | medium | 5.8 | 1% |
| CVE-2021-4334 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check | high | 8.8 | 1% |
| CVE-2023-0619 | kraken-image-optimizer (WordPress plugin) | The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actio | medium | 6.5 | 1% |
| CVE-2022-0775 | woocommerce (WordPress plugin) | The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenti | medium | 4.3 | 1% |
| CVE-2026-8236 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR combined with a missing authentication gate | medium | 0.0 | 1% |
| CVE-2024-0377 | lifterlms (WordPress plugin) | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 1% |
| CVE-2024-1862 | woocommerce-add-to-cart-custom-redirect (WordPress plugin) | The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to | high | 8.1 | 1% |
| CVE-2024-32003 | winter/wn-dusk-plugin | Dusk plugin may allow unfettered user authentication in misconfigured installs | high | 8.8 | 1% |
| CVE-2021-4350 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This | high | 7.2 | 1% |
| CVE-2025-5071 | ai-engine (WordPress plugin) | The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on | high | 8.8 | 1% |
| CVE-2021-24633 | countdown-block (WordPress plugin) | The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authen | medium | 4.3 | 1% |
| CVE-2024-6328 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions u | critical | 9.8 | 1% |
| CVE-2023-6327 | woolentor-addons (WordPress plugin) | The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t | medium | 5.3 | 1% |
| CVE-2021-39347 | woo-stripe-payment (WordPress plugin) | The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stri | medium | 4.3 | 1% |
| CVE-2023-5425 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | high | 8.8 | 1% |
| CVE-2021-24281 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_acti | medium | 4.3 | 1% |
| CVE-2023-2434 | wp-nested-pages (WordPress plugin) | The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function i | low | 3.8 | 1% |
| CVE-2022-40316 | moodle/moodle | Moodle No groups filtering in H5P activity attempts report | medium | 4.3 | 1% |
| CVE-2021-4371 | wp-quick-front-end-editor (WordPress plugin) | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lack | medium | 4.3 | 1% |
| CVE-2021-34648 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Rout | medium | 6.4 | 1% |
| CVE-2021-4348 | ultimate-gdpr-\&-ccpa-compliance-toolkit (WordPress plugin) | The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_s | high | 7.5 | 1% |
| CVE-2021-4347 | advanced-shipment-tracking-for-woocommerce (WordPress plugin) | The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vul | critical | 9.9 | 1% |
| CVE-2023-0890 | shortcodes-ultimate (WordPress plugin) | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some sho | medium | 6.5 | 1% |
| CVE-2023-0911 | shortcodes-ultimate (WordPress plugin) | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the | medium | 6.5 | 1% |
| CVE-2023-1371 | w4-post-list (WordPress plugin) | The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content | medium | 6.5 | 1% |
| CVE-2024-1043 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check | medium | 6.5 | 1% |
| CVE-2022-0762 | microweber/microweber | Exposure of Resource to Wrong Sphere in microweber | medium | 4.3 | 1% |
| CVE-2025-46348 | yeswiki/yeswiki | YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download | critical | 10.0 | 1% |
| CVE-2024-1479 | wp-show-posts (WordPress plugin) | The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the w | medium | 5.3 | 1% |
| CVE-2021-25084 | advanced-cron-manager (WordPress plugin) | The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisatio | medium | 4.3 | 1% |
| CVE-2023-29288 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-29295 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-29296 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-6383 | debug-log-manager (WordPress plugin) | The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download | high | 7.5 | 1% |
| CVE-2021-24500 | workreap (WordPress plugin) | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct obj | high | 8.1 | 1% |
| CVE-2023-0298 | grumpydictator/firefly-iii | Improper Authorization in grumpydictator/firefly-iii | medium | 6.5 | 1% |
| CVE-2022-4937 | wc-frontend-manager (WordPress plugin) | The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and includin | medium | 6.3 | 1% |
| CVE-2023-5054 | super-store-finder (WordPress plugin) | The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and inclu | medium | 5.8 | 1% |
| CVE-2022-0333 | moodle/moodle | Insufficient user authorization in Moodle | low | 3.8 | 1% |
| CVE-2023-2351 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability ch | medium | 6.5 | 1% |
| CVE-2026-8237 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR | medium | 0.0 | 1% |
| CVE-2022-0179 | snipe/snipe-it | Incorrect Default Permissions and Improper Access Control in snipe-it | medium | 5.4 | 1% |
| CVE-2023-2299 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via th | medium | 5.3 | 1% |
| CVE-2023-5533 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding | medium | 5.3 | 1% |
| CVE-2026-45260 | pimcore/pimcore | Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling | high | 8.1 | 1% |