Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10924 | really-simple-ssl (WordPress plugin) | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to | critical | 9.8 | 82% |
| CVE-2023-2732 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insuffici | critical | 9.8 | 67% |
| CVE-2023-2982 | miniorange-login-openid (WordPress plugin) | The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in | critical | 9.8 | 46% |
| CVE-2023-2986 | woocommerce-abandoned-cart (WordPress plugin) | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2 | critical | 9.8 | 43% |
| CVE-2024-9989 | crypto (WordPress plugin) | The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbi | critical | 9.8 | 7% |
| CVE-2023-2437 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient | critical | 9.8 | 7% |
| CVE-2023-2734 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insuffici | critical | 9.8 | 4% |
| CVE-2024-8943 | latepoint (WordPress plugin) | The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insuffic | critical | 9.8 | 3% |
| CVE-2022-0992 | security-optimizer (WordPress plugin) | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administr | critical | 9.8 | 3% |
| CVE-2023-3277 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, | critical | 9.8 | 3% |
| CVE-2023-2834 | bookit (WordPress plugin) | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient | critical | 9.8 | 2% |
| CVE-2024-8277 | woocommerce-photo-reviews (WordPress plugin) | The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3. | critical | 9.8 | 2% |
| CVE-2023-2704 | bp-social-connect (WordPress plugin) | The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insu | critical | 9.8 | 2% |
| CVE-2020-36713 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestric | critical | 9.8 | 2% |
| CVE-2020-36724 | wordable (WordPress plugin) | The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of | critical | 9.8 | 2% |
| CVE-2020-4050 | WordPress core | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It | low | 3.5 | 1% |
| CVE-2012-2356 | moodle/moodle | Moodle Authentication Bypass in Question-Bank | medium | 0.0 | 1% |
| CVE-2023-2546 | wp-user-switch (WordPress plugin) | The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incor | high | 8.8 | 1% |
| CVE-2023-2499 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to | critical | 9.8 | 1% |
| CVE-2024-11028 | multimanager-wp (WordPress plugin) | The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up | critical | 9.8 | 1% |
| CVE-2023-2733 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insuffici | critical | 9.8 | 1% |
| CVE-2024-11349 | adforest (WordPress plugin) | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plug | critical | 9.8 | 1% |
| CVE-2023-3162 | payment-gateway-stripe-and-woocommerce-integration (WordPress plugin) | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7. | critical | 9.8 | 1% |
| CVE-2023-2781 | woo-confirmation-email (WordPress plugin) | The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in ve | high | 8.1 | 1% |
| CVE-2020-26136 | silverstripe/graphql | Authentication bypass in SilverStripe GraphQL | medium | 6.5 | 1% |
| CVE-2024-9988 | crypto (WordPress plugin) | The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing valida | critical | 9.8 | 1% |
| CVE-2023-3249 | web3-authentication (WordPress plugin) | The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and includi | critical | 9.8 | 1% |
| CVE-2023-2027 | zm-ajax-login-register (WordPress plugin) | The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is du | critical | 9.8 | 1% |
| CVE-2024-7781 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to i | high | 8.1 | 1% |
| CVE-2024-9822 | pedalo-connector (WordPress plugin) | The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to ins | critical | 9.8 | 1% |
| CVE-2024-9488 | wpdiscuz (WordPress plugin) | The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is du | critical | 9.8 | 1% |
| CVE-2024-12857 | adforest (WordPress plugin) | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plug | critical | 9.8 | 1% |
| CVE-2021-4353 | woocommerce-dynamic-pricing-\&-discounts (WordPress plugin) | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and i | medium | 5.3 | 1% |
| CVE-2024-6397 | instawp-connect (WordPress plugin) | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and | critical | 9.8 | 1% |
| CVE-2024-6328 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions u | critical | 9.8 | 1% |
| CVE-2024-5432 | lifeline-donation (WordPress plugin) | The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to in | critical | 9.8 | 1% |
| CVE-2025-1909 | buddyboss-platform (WordPress plugin) | The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due | critical | 9.8 | 1% |
| CVE-2024-7628 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to | high | 8.1 | 1% |
| CVE-2024-11286 | jobcareer (WordPress plugin) | The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to the plu | critical | 9.8 | 1% |
| CVE-2024-9861 | miniorange-firebase-sms-otp-verification (WordPress plugin) | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, | high | 8.1 | 1% |
| CVE-2024-7503 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is | critical | 9.8 | 1% |
| CVE-2024-37893 | grumpydictator/firefly-iii | Firefly III has a MFA bypass in oauth flow | medium | 5.9 | 1% |
| CVE-2025-1717 | login-me-now (WordPress plugin) | The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecur | high | 8.1 | 1% |
| CVE-2024-9289 | affiliate-pro (WordPress plugin) | The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and includi | critical | 9.8 | 1% |
| CVE-2024-10002 | rover-idx (WordPress plugin) | The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insuf | high | 8.8 | 1% |
| CVE-2024-13553 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versi | critical | 9.8 | 1% |
| CVE-2025-1315 | injob (WordPress plugin) | The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. T | critical | 9.8 | 1% |
| CVE-2025-6688 | simple-payment (WordPress plugin) | The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not pro | critical | 9.8 | 0% |
| CVE-2024-9522 | wp-users-masquerade (WordPress plugin) | The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to | high | 8.8 | 0% |
| CVE-2025-4973 | workreap (WordPress plugin) | The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in a | critical | 9.8 | 0% |