Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-1376 | pixabay-images (WordPress plugin) | pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated user | medium | 4.0 | 33% |
| CVE-2021-24146 | modern-events-calendar-lite (WordPress plugin) | Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access t | high | 7.5 | 31% |
| CVE-2021-4119 | ssddanbrown/bookstack | BookStack is vulnerable to Improper Access Control. | medium | 5.3 | 27% |
| CVE-2010-3714 | typo3/cms | TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism | high | 0.0 | 24% |
| CVE-2015-3302 | thecartpress-ecommerce-shopping-cart (WordPress plugin) | The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote | high | 7.5 | 22% |
| CVE-2026-33478 | wwbn/avideo | AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection | critical | 10.0 | 13% |
| CVE-2022-1631 | microweber/microweber | Incorrect Authorization in microweber | high | 8.8 | 9% |
| CVE-2021-24215 | controlled-admin-access (WordPress plugin) | An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to | critical | 9.8 | 9% |
| CVE-2015-4050 | symfony/http-kernel, symfony/symfony | Symfony Incorrect Access Control | medium | 0.0 | 8% |
| CVE-2015-5623 | WordPress core | WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access | medium | 4.0 | 8% |
| CVE-2015-1000010 | simple-image-manipulator (WordPress plugin) | Remote file download in simple-image-manipulator v1.0 wordpress plugin | high | 7.5 | 7% |
| CVE-2021-36888 | image-hover-effects-ultimate (WordPress plugin) | Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versio | critical | 9.8 | 7% |
| CVE-2022-25481 | topthink/framework | Exposure of Resource to Wrong Sphere in ThinkPHP Framework | high | 7.5 | 5% |
| CVE-2021-4380 | pinterest-automatic-pin (WordPress plugin) | The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_aut | critical | 9.8 | 4% |
| CVE-2015-2792 | wpml (WordPress plugin) | The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass n | high | 7.5 | 4% |
| CVE-2019-12468 | mediawiki/core | Wikimedia MediaWiki Incorrect Access Control vulnerability | critical | 9.8 | 3% |
| CVE-2011-2687 | drupal/core | Drupal Access Control Bypass | high | 0.0 | 3% |
| CVE-2020-5244 | buddypress/buddypress | Private data exposure via REST API in BuddyPress | high | 8.0 | 2% |
| CVE-2024-0324 | profile-builder (WordPress plugin) | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | high | 8.2 | 2% |
| CVE-2021-21020 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control | medium | 5.3 | 2% |
| CVE-2020-11028 | WordPress core | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specif | medium | 5.8 | 2% |
| CVE-2022-34255 | magento/community-edition | Magento Improper Access Control vulnerability | high | 8.8 | 2% |
| CVE-2015-1000009 | google-adsense-and-hotel-booking (WordPress plugin) | Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05 | critical | 9.1 | 2% |
| CVE-2018-13258 | mediawiki/core | Mediawiki tarball is missing .htaccess files | medium | 5.3 | 2% |
| CVE-2008-4793 | drupal/drupal | Drupal Node Validation Bypass in the node module API | high | 0.0 | 2% |
| CVE-2019-6342 | drupal/core, drupal/drupal | In Drupal 8.7.4, when the [experimental](https://www.drupal.org/core/experimental#beta) Workspaces module is enabled, an | critical | 9.8 | 2% |
| CVE-2011-4300 | moodle/moodle | Moodle does not properly restrict access to category and course data | medium | 0.0 | 2% |
| CVE-2021-36036 | magento/community-edition, magento/project-community-edition | Magento improper access control vulnerability within Magento's Media Gallery Upload workflow | critical | 9.1 | 2% |
| CVE-2021-24219 | focusblog (WordPress plugin), ignition (WordPress plugin), luxe (WordPress plugin) +17 more | The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress | medium | 5.3 | 2% |
| CVE-2021-36917 | hide-my-wp (WordPress plugin) | WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token whi | medium | 6.5 | 2% |
| CVE-2018-21007 | woo-confirmation-email (WordPress plugin) | The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads. | critical | 9.8 | 2% |
| CVE-2020-25698 | moodle/moodle | Improper Access Control in moodle | high | 7.5 | 2% |
| CVE-2021-36909 | wp-reset-pro (WordPress plugin) | Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe | high | 8.8 | 2% |
| CVE-2012-2153 | drupal/drupal | Drupal improper access restrictions | medium | 0.0 | 2% |
| CVE-2017-11365 | symfony/security, symfony/security-core, symfony/symfony | Symfony Incorrect Access Control | critical | 9.8 | 2% |
| CVE-2019-25060 | wp-graphql/wp-graphql, wpgraphql (WordPress plugin) | Improper Access Control in wp-graphql | medium | 5.3 | 2% |
| CVE-2017-18543 | invite-anyone (WordPress plugin) | The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations. | critical | 9.8 | 2% |
| CVE-2013-1830 | moodle/moodle | Moodle does not enforce the forceloginforprofiles setting | medium | 0.0 | 2% |
| CVE-2021-43996 | facade/ignition | Incorrect Access Control in Ignition | critical | 9.8 | 2% |
| CVE-2022-0541 | flo-launch (WordPress plugin) | The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate | critical | 9.8 | 2% |
| CVE-2013-1834 | moodle/moodle | Moodle allows remote authenticated users to reassign notes | medium | 0.0 | 2% |
| CVE-2016-10148 | WordPress core | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checkin | medium | 4.3 | 2% |
| CVE-2021-24583 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any us | medium | 4.3 | 2% |
| CVE-2022-34259 | magento/community-edition | Magento Improper Access Control vulnerability | medium | 5.3 | 2% |
| CVE-2015-2267 | moodle/moodle | Moodle allows attackers to extract archives to arbitrary directories | medium | 0.0 | 2% |
| CVE-2017-6919 | drupal/core, drupal/drupal | Drupal access control bypass vulnerability | high | 7.5 | 2% |
| CVE-2016-3162 | drupal/core, drupal/drupal | Drupal File upload access bypass and denial of service | high | 8.1 | 2% |
| CVE-2013-2081 | moodle/moodle | Moodle does not consider "don't send" attributes during hub registration | medium | 0.0 | 2% |
| CVE-2014-6289 | dl/yag, punktde/pt_extbase | yag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions | high | 0.0 | 2% |
| CVE-2021-24374 | automattic/jetpack, jetpack (WordPress plugin) | JetPack Exposure of Resource to Wrong Sphere | medium | 5.3 | 1% |