Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-48009 | shopware/core, shopware/platform | Shopware: Admin Account Takeover via User Recovery Hash Exposure | medium | 6.8 | 0% |
| CVE-2024-11090 | restrict-content (WordPress plugin) | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc | medium | 5.3 | 0% |
| CVE-2024-0708 | landing-page-cat (WordPress plugin) | The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposu | medium | 5.3 | 0% |
| CVE-2023-52185 | everest-backup (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration | medium | 5.3 | 0% |
| CVE-2024-0910 | restrict-for-elementor (WordPress plugin) | The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 | medium | 5.3 | 0% |
| CVE-2024-5615 | opengraph (WordPress plugin) | The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'op | medium | 5.3 | 0% |
| CVE-2024-6448 | mollie-payments-for-woocommerce (WordPress plugin) | The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. | medium | 5.3 | 0% |
| CVE-2024-6554 | branda-white-labeling (WordPress plugin) | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions | medium | 5.3 | 0% |
| CVE-2024-7426 | peepso-core (WordPress plugin) | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure | medium | 5.3 | 0% |
| CVE-2024-6567 | ebook-store (WordPress plugin) | The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the | medium | 5.3 | 0% |
| CVE-2024-13525 | emails-verification-for-woocommerce (WordPress plugin) | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 6.5 | 0% |
| CVE-2023-49162 | bigcommerce (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BigCommerce BigCommerce For WordPress.This issue affects BigComm | medium | 5.3 | 0% |
| CVE-2024-13562 | import-wp (WordPress plugin) | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all | high | 7.5 | 0% |
| CVE-2024-13796 | post-grid (WordPress plugin) | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 5.3 | 0% |
| CVE-2024-8483 | mas-static-content (WordPress plugin) | The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the static | medium | 4.3 | 0% |
| CVE-2023-45824 | oro/platform | Pinned entity creation form shows wrong data | medium | 4.3 | 0% |
| CVE-2023-48296 | oro/customer-portal | Storefront user can access history and most viewed data from matching back-office user with the same ID | medium | 4.3 | 0% |
| CVE-2024-8516 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 v | medium | 4.3 | 0% |
| CVE-2024-11083 | wp-user-avatar (WordPress plugin) | The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the | medium | 5.3 | 0% |
| CVE-2024-6499 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7. | medium | 5.3 | 0% |
| CVE-2024-7415 | remember-me-controls (WordPress plugin) | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due | medium | 5.3 | 0% |
| CVE-2024-10312 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including | medium | 4.3 | 0% |
| CVE-2024-13568 | fluent-support (WordPress plugin) | The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all v | high | 7.5 | 0% |
| CVE-2024-13606 | js-support-ticket (WordPress plugin) | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi | high | 7.5 | 0% |
| CVE-2024-10356 | element-ready-lite (WordPress plugin) | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | medium | 4.3 | 0% |
| CVE-2025-4798 | wp-downloadmanager (WordPress plugin) | The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due | medium | 4.9 | 0% |
| CVE-2024-43257 | leopard (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects L | medium | 6.5 | 0% |
| CVE-2026-76089 | verbb/formie | Formie: Missing authorization on sent notification resend modal exposes submission PII | high | 7.7 | 0% |
| CVE-2024-6687 | ctt-expresso-para-woocommerce (WordPress plugin) | The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3 | medium | 5.3 | 0% |
| CVE-2024-10329 | ultimate-bootstrap-elements-for-elementor (WordPress plugin) | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an | medium | 4.3 | 0% |
| CVE-2024-7417 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2024-8801 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3. | medium | 4.3 | 0% |
| CVE-2025-66304 | getgrav/grav | Grav Exposes Password Hashes Leading to privilege escalation | medium | 6.2 | 0% |
| CVE-2024-11282 | content-protector (WordPress plugin) | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to | medium | 5.3 | 0% |
| CVE-2024-3679 | premium-seo-pack (WordPress plugin) | The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2026-72698 | getgrav/grav | Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths | medium | 6.5 | 0% |
| CVE-2026-24422 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Public API endpoints expose emails and invisible questions | medium | 5.3 | 0% |
| CVE-2024-8899 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via t | medium | 4.3 | 0% |
| CVE-2025-12558 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-29885 | silverstripe/reports | Silverstripe Reports are still accessible even when `canView()` returns false | medium | 4.3 | 0% |
| CVE-2024-9538 | woolentor-addons (WordPress plugin) | The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'ren | medium | 4.3 | 0% |
| CVE-2024-9530 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 | medium | 4.3 | 0% |
| CVE-2024-6757 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versio | medium | 4.3 | 0% |
| CVE-2024-9540 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2024-10548 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via | medium | 6.5 | 0% |
| CVE-2026-33761 | wwbn/avideo | AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings | medium | 5.3 | 0% |
| CVE-2024-6455 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due | medium | 5.3 | 0% |
| CVE-2024-6544 | custom-post-limits (WordPress plugin) | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due t | medium | 5.3 | 0% |
| CVE-2025-2252 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Expo | medium | 5.3 | 0% |
| CVE-2026-62998 | redaxo/source | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration | medium | 4.3 | 0% |