Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-39341 | optinmonster (WordPress plugin) | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient aut | high | 8.2 | 22% |
| CVE-2025-24434 | magento/community-edition, magento/project-community-edition | Improper Authorization vulnerability in Magento and Adobe Commerce | critical | 9.1 | 17% |
| CVE-2022-0993 | siteground-security (WordPress plugin) | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administr | high | 8.1 | 8% |
| CVE-2022-24894 | symfony/http-kernel, symfony/symfony | Symfony storing cookie headers in HttpCache | medium | 5.9 | 4% |
| CVE-2021-36029 | magento/community-edition, magento/project-community-edition | Magento improper authorization vulnerability | high | 7.2 | 2% |
| CVE-2021-21022 | magento/community-edition, magento/project-community-edition | Magento Insecure Direct Object Reference (IDOR) in the product module | medium | 5.3 | 2% |
| CVE-2022-34256 | magento/community-edition | Magento Improper Authorization vulnerability | high | 7.5 | 2% |
| CVE-2020-24404 | magento/community-edition | Magento 2 Community Edition vulnerable to Improper Authorization | low | 2.7 | 2% |
| CVE-2021-21026 | magento/community-edition, magento/project-community-edition | Magento improper authorization vulnerability in the integrations module | medium | 5.3 | 2% |
| CVE-2021-36037 | magento/community-edition, magento/project-community-edition | Magento is affected by an improper authorization vulnerability | medium | 6.5 | 2% |
| CVE-2026-24421 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) | medium | 6.5 | 2% |
| CVE-2021-39317 | access-demo-importer (WordPress plugin), accesspress-basic (WordPress plugin), accesspress-lite (WordPress plugin) +40 more | A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offl | high | 8.8 | 2% |
| CVE-2020-24402 | magento/community-edition, magento/project-community-edition | Magento incorrect permissions vulnerability in the Integrations component | medium | 4.9 | 2% |
| CVE-2020-24403 | magento/community-edition, magento/project-community-edition | Magento incorrect user permissions vulnerability within the Inventory component | low | 2.7 | 2% |
| CVE-2020-24405 | magento/community-edition | Magento incorrect permissions vulnerability in the Inventory module | medium | 4.3 | 2% |
| CVE-2022-2536 | transposh-translation-filter-for-wordpress (WordPress plugin) | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions | medium | 5.3 | 1% |
| CVE-2021-28563 | magento/community-edition | Magento Unauthorized access to restricted resources | medium | 6.5 | 1% |
| CVE-2025-66301 | getgrav/grav | Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions | high | 0.0 | 1% |
| CVE-2021-24188 | wp-content-copy-protection-\&-no-right-click (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click Wo | high | 8.8 | 1% |
| CVE-2021-24189 | captchinoo (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login p | high | 8.8 | 1% |
| CVE-2021-24190 | conditional-marketing-mailer (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordP | high | 8.8 | 1% |
| CVE-2021-24192 | sitemap (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to i | high | 8.8 | 1% |
| CVE-2021-24193 | visitor-traffic-real-time-statistics (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress | high | 8.8 | 1% |
| CVE-2021-24194 | login-protection---limit-failed-login-attempts (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts | high | 8.8 | 1% |
| CVE-2021-24195 | login-as-user-or-customer-\(user-switching\) (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) Wor | high | 8.8 | 1% |
| CVE-2019-10154 | moodle/moodle | Moodle all messaging conversations could be viewed | high | 7.5 | 1% |
| CVE-2021-24191 | coming-soon-page-\&-maintenance-mode (WordPress plugin) | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction | high | 8.8 | 1% |
| CVE-2025-1361 | ip2location-country-blocker (WordPress plugin) | The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.3 | high | 7.5 | 1% |
| CVE-2020-5275 | symfony/security, symfony/security-http, symfony/symfony | Firewall configured with unanimous strategy was not actually unanimous in Symfony | high | 7.6 | 1% |
| CVE-2019-14883 | moodle/moodle | Moodle Email media URL tokens were not checking for user status | medium | 5.3 | 1% |
| CVE-2020-36696 | product-input-fields-for-woocommerce (WordPress plugin) | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the | high | 7.5 | 1% |
| CVE-2022-0587 | librenms/librenms | Improper Authorization in librenms | high | 7.1 | 1% |
| CVE-2023-4243 | full-customer (WordPress plugin) | The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and in | high | 8.8 | 1% |
| CVE-2019-7872 | magento/community-edition, magento/product-community-edition | Magento Insufficient authorization check when adding users to company accounts | medium | 6.5 | 1% |
| CVE-2021-28567 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability in the customers module | medium | 5.0 | 1% |
| CVE-2023-38220 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Authorization | high | 7.5 | 1% |
| CVE-2023-2496 | go-pricing (WordPress plugin) | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an imp | high | 7.1 | 1% |
| CVE-2024-34104 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | high | 8.2 | 1% |
| CVE-2023-47109 | prestashop/blockreassurance | PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block | medium | 5.5 | 1% |
| CVE-2022-4701 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX act | medium | 4.3 | 1% |
| CVE-2024-47053 | mautic/core | Mautic allows Improper Authorization in Reporting API | high | 7.7 | 1% |
| CVE-2024-45132 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 6.5 | 1% |
| CVE-2020-36729 | 2j-slideshow (WordPress plugin) | The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' | medium | 5.4 | 1% |
| CVE-2025-24409 | magento/community-edition, magento/project-community-edition | Adobe Commerce Improper Authorization vulnerability | high | 8.2 | 1% |
| CVE-2024-25108 | pixelfed/pixelfed | Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions | critical | 9.9 | 1% |
| CVE-2021-4334 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check | high | 8.8 | 1% |
| CVE-2022-4868 | froxlor/froxlor | Froxlor Improper Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2024-1043 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check | medium | 6.5 | 1% |
| CVE-2023-0298 | grumpydictator/firefly-iii | Improper Authorization in grumpydictator/firefly-iii | medium | 6.5 | 1% |
| CVE-2023-0609 | wallabag/wallabag | wallabag contains Improper Authorization via export feature | medium | 6.5 | 1% |