Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8253 | post-grid (WordPress plugin) | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due | high | 8.8 | 9% |
| CVE-2023-1874 | wp-data-access (WordPress plugin) | The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack | high | 7.5 | 3% |
| CVE-2023-6009 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restricti | high | 8.8 | 1% |
| CVE-2023-4153 | ban-users (WordPress plugin) | The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capability | high | 8.8 | 1% |
| CVE-2024-2409 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to i | critical | 9.8 | 1% |
| CVE-2024-13421 | real-estate-7 (WordPress plugin) | The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is d | critical | 9.8 | 1% |
| CVE-2024-12213 | superio (WordPress plugin) | The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allo | critical | 9.8 | 1% |
| CVE-2024-8420 | dhvc-form (WordPress plugin) | The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plu | critical | 9.8 | 1% |
| CVE-2025-1653 | ulisting (WordPress plugin) | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and inc | high | 8.8 | 1% |
| CVE-2025-6735 | juzaweb/cms | JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing Import Page component | medium | 6.3 | 0% |
| CVE-2025-6736 | juzaweb/cms | JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components | medium | 6.3 | 0% |
| CVE-2024-9519 | userplus (WordPress plugin) | The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabo | high | 7.2 | 0% |
| CVE-2026-24749 | silverstripe/assets | Silverstripe Assets Module has a DBFile::getURL() permission bypass | medium | 5.3 | 0% |
| CVE-2026-14794 | craftcms/cms | Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics | medium | 4.3 | 0% |
| CVE-2026-35671 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: IDOR Account Takeover | high | 8.8 | 0% |
| CVE-2026-1193 | mineadmin/mineadmin | MineAdmin has Incorrect Privilege Assignment | medium | 6.3 | 0% |
| CVE-2024-50701 | nilsteampassnet/teampass | TeamPass does not properly check whether a folder is in a user's allowed folders list | medium | 4.3 | 0% |
| CVE-2026-2896 | funadmin/funadmin | funadmin has Incorrect Privilege Assignment in its Configuration Handler | high | 7.3 | 0% |
| CVE-2025-66296 | getgrav/grav | Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover | high | 8.8 | 0% |
| CVE-2024-50702 | nilsteampassnet/teampass | TeamPass mail_me operation authorization issue | medium | 5.4 | 0% |
| CVE-2026-10215 | dolibarr/dolibarr | Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API | medium | 4.3 | 0% |