Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-24637 | open-web-analytics/open-web-analytics | Improper Privilege Management in Open Web Analytics | critical | 9.8 | 99% |
| CVE-2022-0441 | masterstudy-lms (WordPress plugin) | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenti | critical | 9.8 | 85% |
| CVE-2021-34621 | profilepress (WordPress plugin) | A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin | critical | 9.8 | 69% |
| CVE-2020-13693 | bbpress (WordPress plugin), bbpress/bbpress | An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. | critical | 9.8 | 44% |
| CVE-2023-2833 | reviewx (WordPress plugin) | The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restrict | high | 8.8 | 17% |
| CVE-2020-36155 | ultimate-member (WordPress plugin) | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. A | critical | 10.0 | 10% |
| CVE-2016-10972 | newspaper (WordPress theme) | The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel. | critical | 9.8 | 9% |
| CVE-2020-26596 | elementor-pro (WordPress plugin) | The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code | high | 8.8 | 6% |
| CVE-2021-34622 | profilepress (WordPress plugin) | A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugi | critical | 9.8 | 4% |
| CVE-2020-9630 | magento/community-edition, magento/core, magento/project-community-edition | Magento business logic error vulnerability | critical | 9.8 | 4% |
| CVE-2024-34082 | getgrav/grav | Grav Vulnerable to Arbitrary File Read to Account Takeover | high | 8.5 | 3% |
| CVE-2017-6925 | drupal/core, drupal/drupal | Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions | critical | 9.8 | 3% |
| CVE-2024-6624 | json-api-user (WordPress plugin) | The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to imp | critical | 9.8 | 3% |
| CVE-2018-21025 | centreon/centreon | Centreon Privilege Escalation | critical | 9.8 | 3% |
| CVE-2016-6211 | drupal/core, drupal/drupal | Drupal Saving user accounts can sometimes grant the user all roles | high | 8.8 | 3% |
| CVE-2017-18264 | phpmyadmin/phpmyadmin | phpMyAdmin Improper Privilege Management | critical | 9.8 | 3% |
| CVE-2025-4334 | wp-registration (WordPress plugin) | The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is d | critical | 9.8 | 3% |
| CVE-2019-20043 | WordPress core | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the r | medium | 4.3 | 2% |
| CVE-2020-7047 | wordpress-database-reset (WordPress plugin) | The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability | high | 8.8 | 2% |
| CVE-2020-23489 | wwbn/avideo | AVideo vulnerable to Improper Privilege Management | high | 8.8 | 2% |
| CVE-2011-4941 | matomo/matomo, piwik/piwik | Piwik (now Matomo) Vulnerable to Arbitrary Code Execution | medium | 0.0 | 2% |
| CVE-2016-3169 | drupal/core, drupal/drupal | Drupal saving user accounts can sometimes grant the user all roles | high | 8.1 | 2% |
| CVE-2017-6924 | drupal/core, drupal/drupal | Drupal REST API can bypass comment approval | high | 7.4 | 2% |
| CVE-2020-36156 | ultimate-member (WordPress plugin) | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update | critical | 9.9 | 2% |
| CVE-2018-21013 | swape (WordPress theme) | The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors | critical | 9.8 | 2% |
| CVE-2020-10793 | codeigniter4/framework | CodeIgniter Improper Privilege Management | high | 8.8 | 2% |
| CVE-2016-11002 | extra (WordPress theme) | The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation. | high | 8.8 | 2% |
| CVE-2016-11003 | bloom (WordPress plugin) | The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation. | high | 8.8 | 2% |
| CVE-2016-11004 | monarch (WordPress plugin) | The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation. | high | 8.8 | 2% |
| CVE-2016-10971 | membersonic (WordPress plugin) | The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is re | critical | 9.8 | 2% |
| CVE-2015-10139 | wordpress-learning-management-system- (WordPress theme) | The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. | high | 8.8 | 2% |
| CVE-2020-12074 | import-export-wordpress-users (WordPress plugin) | The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts | high | 8.8 | 2% |
| CVE-2016-7570 | drupal/core, drupal/drupal | Drupal Users without "Administer comments" can set comment visibility on nodes they can edit | medium | 4.3 | 2% |
| CVE-2020-14201 | dolibarr/dolibarr | Dolibarr CRM allows Privilege Escalation | medium | 6.5 | 2% |
| CVE-2020-25699 | moodle/moodle | Privilage Escalation in moodle | high | 7.5 | 2% |
| CVE-2016-10968 | peepso-core (WordPress plugin) | The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation. | high | 8.8 | 2% |
| CVE-2018-0503 | mediawiki/core | Mediawiki Improper Privilege Management | medium | 4.3 | 2% |
| CVE-2021-24602 | hm-multiple-roles (WordPress plugin) | The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin | high | 8.8 | 2% |
| CVE-2022-2317 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient che | critical | 9.8 | 1% |
| CVE-2017-18596 | elementor (WordPress plugin) | The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions. | high | 8.8 | 1% |
| CVE-2016-11011 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation. | medium | 6.5 | 1% |
| CVE-2011-2674 | baserproject/basercms | BaserCMS privilege escallation | medium | 0.0 | 1% |
| CVE-2022-43138 | dolibarr/dolibarr | Dolibarr vulnerable to privilege escalation | critical | 9.8 | 1% |
| CVE-2017-7489 | moodle/moodle | Moodle External blog editing takeover | medium | 6.3 | 1% |
| CVE-2022-0611 | snipe/snipe-it | Improper Privilege Management in Snipe-IT | high | 8.8 | 1% |
| CVE-2025-7341 | ht-contactform (WordPress plugin) | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file | critical | 9.1 | 1% |
| CVE-2022-2273 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowi | high | 8.8 | 1% |
| CVE-2021-43835 | sulu/sulu | Privilege escalation in the Sulu Admin panel | high | 7.2 | 1% |
| CVE-2022-1397 | alextselegidis/easyappointments | Privilege escalation in easyappointments | high | 8.8 | 1% |
| CVE-2021-24289 | store-locator-plus (WordPress plugin) | There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update | high | 8.8 | 1% |