Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24635 | visual-link-preview (WordPress plugin) | The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displaye | medium | 5.4 | 1% |
| CVE-2021-4366 | pwa-for-wp-\&-amp (WordPress plugin) | The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_fe | medium | 6.3 | 1% |
| CVE-2024-10008 | learning-management-system (WordPress plugin) | The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modifi | high | 8.8 | 1% |
| CVE-2025-2025 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing cap | medium | 6.5 | 1% |
| CVE-2024-10802 | hash-elements (WordPress plugin) | The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_g | medium | 5.3 | 1% |
| CVE-2023-1843 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing ca | medium | 6.5 | 1% |
| CVE-2020-15245 | sylius/sylius | Ability to switch customer email address on account detail page and stay verified | medium | 4.3 | 1% |
| CVE-2021-40692 | moodle/moodle | Moodle Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2019-15648 | insert-or-embed-articulate-content-into-wordpress (WordPress plugin) | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam | medium | 6.5 | 1% |
| CVE-2024-2543 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_u | medium | 4.3 | 1% |
| CVE-2024-7031 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | high | 7.5 | 1% |
| CVE-2022-0720 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update oth | medium | 5.4 | 1% |
| CVE-2022-0837 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send | medium | 5.4 | 1% |
| CVE-2021-4338 | 404-to-301 (WordPress plugin) | The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redir | medium | 6.4 | 1% |
| CVE-2024-6660 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modif | high | 8.8 | 1% |
| CVE-2023-3814 | advanced-file-manager (WordPress plugin) | The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site ad | medium | 4.9 | 1% |
| CVE-2023-1868 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin c | medium | 6.5 | 1% |
| CVE-2024-6088 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check | medium | 5.3 | 1% |
| CVE-2024-3607 | propertyhive (WordPress plugin) | The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() | medium | 4.3 | 1% |
| CVE-2024-11334 | my-contador-wp (WordPress plugin) | The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportar_reg | medium | 4.3 | 1% |
| CVE-2022-1589 | all-in-one-login (WordPress plugin) | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updati | high | 7.5 | 1% |
| CVE-2023-6048 | estatik (WordPress plugin) | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from s | medium | 6.5 | 1% |
| CVE-2023-4637 | wpvivid-backuprestore (WordPress plugin) | The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_res | medium | 4.3 | 1% |
| CVE-2023-2085 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templa | medium | 4.3 | 1% |
| CVE-2023-4668 | ad-inserter (WordPress plugin) | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-proc | medium | 5.3 | 1% |
| CVE-2024-1176 | ht-easy-google-analytics (WordPress plugin) | The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 1% |
| CVE-2021-4375 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_sy | medium | 4.3 | 1% |
| CVE-2023-25575 | api-platform/core | api-platform/core's secured properties may be accessible within collections | high | 7.7 | 1% |
| CVE-2024-9941 | wordpress-gym-management-system (WordPress plugin) | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on | high | 8.8 | 1% |
| CVE-2021-4376 | woo-multi-currency (WordPress plugin) | The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This m | medium | 4.3 | 1% |
| CVE-2023-2280 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability ch | medium | 6.5 | 1% |
| CVE-2022-2543 | visual-portfolio\,-photo-gallery-\&-post-grid (WordPress plugin) | The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST | medium | 6.1 | 1% |
| CVE-2023-0712 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object func | medium | 5.4 | 1% |
| CVE-2023-0719 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order | medium | 5.4 | 1% |
| CVE-2022-38057 | th-advance-product-search (WordPress plugin) | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/ | medium | 6.5 | 1% |
| CVE-2025-54263 | magento/community-edition, magento/project-community-edition | Magento provides incorrect authorization through a security feature bypass | high | 8.1 | 1% |
| CVE-2023-0555 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions i | high | 8.1 | 1% |
| CVE-2022-2696 | menu-ordering-reservations (WordPress plugin) | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX a | medium | 6.3 | 1% |
| CVE-2024-1387 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the du | medium | 4.3 | 1% |
| CVE-2026-48489 | symfony/security-http, symfony/symfony | Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes | high | 0.0 | 1% |
| CVE-2025-49556 | magento/community-edition, magento/project-community-edition | Magento has incorrect authorization issue that leads to arbitrary file system read | high | 7.5 | 1% |
| CVE-2023-2189 | stax-addons-for-elementor (WordPress plugin) | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 1% |
| CVE-2023-0293 | mediamatic (WordPress plugin) | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its A | medium | 4.3 | 1% |
| CVE-2024-0907 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 5.3 | 1% |
| CVE-2024-1129 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 5.3 | 1% |
| CVE-2024-1130 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 5.3 | 1% |
| CVE-2024-45128 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 5.4 | 1% |
| CVE-2023-4304 | froxlor/froxlor | Froxlor vulnerable to business logic errors | low | 3.8 | 1% |
| CVE-2022-3622 | blog2social (WordPress plugin) | The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and includin | medium | 4.1 | 1% |
| CVE-2021-25014 | ibtana (WordPress plugin) | The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowin | low | 3.5 | 1% |