Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-1169 | ooohboi-steroids-for-elementor (WordPress plugin) | The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'fil | medium | 4.3 | 1% |
| CVE-2022-4932 | boldgrid-backup (WordPress plugin) | The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missi | medium | 4.3 | 1% |
| CVE-2023-2086 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templa | medium | 4.3 | 1% |
| CVE-2025-54378 | elmsln/haxcms | HAX CMS API Lacks Authorization Checks | high | 8.3 | 1% |
| CVE-2024-2538 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 5.4 | 1% |
| CVE-2023-2083 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save f | medium | 4.3 | 1% |
| CVE-2023-4941 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability | medium | 4.3 | 1% |
| CVE-2023-4943 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability | medium | 4.3 | 1% |
| CVE-2024-3678 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 5.3 | 1% |
| CVE-2023-6557 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 v | medium | 5.3 | 1% |
| CVE-2024-1121 | advanced-forms (WordPress plugin) | The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export | medium | 5.3 | 1% |
| CVE-2023-6158 | eventon (WordPress plugin), eventon-lite (WordPress plugin) | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of da | medium | 6.5 | 1% |
| CVE-2023-2715 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_tick | medium | 4.3 | 1% |
| CVE-2023-5426 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | high | 7.5 | 1% |
| CVE-2023-1022 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInforma | medium | 5.4 | 1% |
| CVE-2023-4469 | profile-extra-fields (WordPress plugin) | The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check | medium | 5.3 | 1% |
| CVE-2021-4074 | whmcs-bridge (WordPress plugin) | The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-br | medium | 6.4 | 1% |
| CVE-2023-35093 | masterstudy-lms (WordPress plugin) | Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 ve | medium | 6.5 | 1% |
| CVE-2023-4198 | dolibarr/dolibarr | Dolibarr Improper Input Validation vulnerability | medium | 6.5 | 1% |
| CVE-2024-1047 | orbit-fox (WordPress plugin) | Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing cap | medium | 5.3 | 1% |
| CVE-2024-11354 | ultimate-youtube-video-player (WordPress plugin) | The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 1% |
| CVE-2020-36670 | nex-forms (WordPress plugin) | The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 | medium | 6.3 | 1% |
| CVE-2023-6965 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, | medium | 4.3 | 1% |
| CVE-2023-2261 | wp-security-audit-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call fun | medium | 4.3 | 1% |
| CVE-2024-43118 | hummingbird (WordPress plugin) | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects | medium | 4.3 | 1% |
| CVE-2022-4943 | miniorange-2-factor-authentication (WordPress plugin) | The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when chan | high | 7.5 | 1% |
| CVE-2024-9578 | hide-links (WordPress plugin) | The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_t | medium | 5.3 | 1% |
| CVE-2023-0993 | wp-simple-firewall (WordPress plugin) | The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, an | medium | 4.3 | 1% |
| CVE-2022-0229 | google-authenticator (WordPress plugin) | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the recon | high | 8.1 | 1% |
| CVE-2021-42367 | variation-swatches-for-woocommerce (WordPress plugin) | The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/i | medium | 6.4 | 1% |
| CVE-2024-1079 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() | medium | 5.3 | 1% |
| CVE-2024-1109 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ini | medium | 5.3 | 1% |
| CVE-2020-36835 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's databa | medium | 4.9 | 1% |
| CVE-2022-41692 | appointment-hour-booking (WordPress plugin) | Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. | medium | 4.3 | 1% |
| CVE-2022-43482 | appointment-booking-calendar (WordPress plugin) | Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. | medium | 4.3 | 1% |
| CVE-2023-1333 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | medium | 4.3 | 1% |
| CVE-2023-1334 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability che | medium | 4.3 | 1% |
| CVE-2023-1335 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability | medium | 4.3 | 1% |
| CVE-2023-1336 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check | medium | 4.3 | 1% |
| CVE-2023-1338 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability che | medium | 4.3 | 1% |
| CVE-2023-1339 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check | medium | 4.3 | 1% |
| CVE-2023-2078 | buymeacoffee (WordPress plugin) | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capa | high | 7.3 | 1% |
| CVE-2024-1352 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification | medium | 6.5 | 1% |
| CVE-2024-5570 | simple-photoswipe (WordPress plugin) | The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authe | medium | 6.5 | 1% |
| CVE-2024-37444 | defender (WordPress plugin) | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects | medium | 5.3 | 1% |
| CVE-2023-6785 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, a | medium | 5.3 | 1% |
| CVE-2024-24822 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle permissions are not getting checked when working with tags | medium | 6.5 | 1% |
| CVE-2024-12812 | wp-erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected | high | 7.5 | 1% |
| CVE-2023-6637 | host-analyticsjs-local (WordPress plugin) | The CAOS | Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 6.5 | 1% |
| CVE-2024-10529 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 5.3 | 1% |