Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-25094 | tatsu (WordPress plugin) | The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is | high | 8.1 | 83% |
| CVE-2024-10924 | really-simple-ssl (WordPress plugin) | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to | critical | 9.8 | 82% |
| CVE-2020-35951 | quiz-and-survey-master (WordPress plugin) | An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as w | critical | 9.9 | 76% |
| CVE-2021-34621 | profilepress (WordPress plugin) | A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin | critical | 9.8 | 69% |
| CVE-2019-9879 | wpgraphql (WordPress plugin) | The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registratio | critical | 9.8 | 46% |
| CVE-2019-13344 | wp-like-button (WordPress plugin) | An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to | medium | 5.3 | 45% |
| CVE-2019-9880 | wpgraphql (WordPress plugin) | An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticat | critical | 9.1 | 35% |
| CVE-2020-7048 | wordpress-database-reset (WordPress plugin) | The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the databas | critical | 9.1 | 23% |
| CVE-2019-15858 | woody-ad-snippets (WordPress plugin) | admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, | high | 8.8 | 20% |
| CVE-2019-9881 | wpgraphql (WordPress plugin) | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even wh | medium | 5.3 | 18% |
| CVE-2020-13405 | microweber/microweber | Microweber Discloses Sensitive Information | high | 7.5 | 14% |
| CVE-2022-2552 | duplicator (WordPress plugin) | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such | medium | 5.3 | 12% |
| CVE-2020-26876 | wp-courses (WordPress plugin) | The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materi | high | 7.5 | 11% |
| CVE-2020-12478 | nilsteampassnet/teampass | TeamPass files are available without authentication | high | 7.5 | 9% |
| CVE-2022-0993 | siteground-security (WordPress plugin) | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administr | high | 8.1 | 8% |
| CVE-2021-36888 | image-hover-effects-ultimate (WordPress plugin) | Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versio | critical | 9.8 | 7% |
| CVE-2019-15896 | lifterlms (WordPress plugin) | An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php | critical | 9.8 | 6% |
| CVE-2022-1598 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allo | medium | 5.3 | 5% |
| CVE-2022-0140 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users t | medium | 5.3 | 4% |
| CVE-2020-11673 | poll-wp (WordPress plugin) | An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., del | critical | 9.8 | 4% |
| CVE-2019-17232 | ultimate-faqs (WordPress plugin) | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. | high | 7.5 | 4% |
| CVE-2019-17234 | igniteup (WordPress plugin) | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion. | high | 7.5 | 3% |
| CVE-2019-15819 | nd-restaurant-reservations (WordPress plugin) | The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication. | critical | 9.8 | 3% |
| CVE-2024-8943 | latepoint (WordPress plugin) | The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insuffic | critical | 9.8 | 3% |
| CVE-2022-0992 | security-optimizer (WordPress plugin) | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administr | critical | 9.8 | 3% |
| CVE-2022-0424 | popup (WordPress plugin) | The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthe | medium | 5.3 | 3% |
| CVE-2020-11028 | WordPress core | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specif | medium | 5.8 | 2% |
| CVE-2022-0188 | cmp-coming-soon-maintenance (WordPress plugin) | The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout. | medium | 5.3 | 2% |
| CVE-2021-24219 | focusblog (WordPress plugin), ignition (WordPress plugin), luxe (WordPress plugin) +17 more | The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress | medium | 5.3 | 2% |
| CVE-2023-2834 | bookit (WordPress plugin) | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient | critical | 9.8 | 2% |
| CVE-2020-20627 | givewp (WordPress plugin) | The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings c | medium | 5.3 | 2% |
| CVE-2022-34858 | oauth-2.0-client-for-sso (WordPress plugin) | Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress. | critical | 9.8 | 2% |
| CVE-2019-15895 | search-exclude (WordPress plugin) | search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes. | high | 7.5 | 2% |
| CVE-2020-5780 | email-subscribers-\&-newsletters (WordPress plugin) | Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a | medium | 5.3 | 2% |
| CVE-2024-8277 | woocommerce-photo-reviews (WordPress plugin) | The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3. | critical | 9.8 | 2% |
| CVE-2023-2704 | bp-social-connect (WordPress plugin) | The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insu | critical | 9.8 | 2% |
| CVE-2020-36713 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestric | critical | 9.8 | 2% |
| CVE-2019-10668 | librenms/librenms | Missing Authentication for Critical Function in LibreNMS | critical | 9.1 | 2% |
| CVE-2020-36724 | wordable (WordPress plugin) | The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of | critical | 9.8 | 2% |
| CVE-2026-47212 | symfony/symfony, symfony/twilio-notifier | Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification | medium | 0.0 | 2% |
| CVE-2026-45332 | automad/automad | Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint | high | 7.5 | 1% |
| CVE-2019-17235 | igniteup (WordPress plugin) | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure. | medium | 5.3 | 1% |
| CVE-2026-42569 | nabeel/phpvms | phpVMS has an /importer authorization bypass causing full database wipe | critical | 9.4 | 1% |
| CVE-2023-2781 | woo-confirmation-email (WordPress plugin) | The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in ve | high | 8.1 | 1% |
| CVE-2024-7781 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to i | high | 8.1 | 1% |
| CVE-2023-4505 | ldap-ad-staff-employee-directory-search (WordPress plugin) | The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and incl | low | 2.2 | 1% |
| CVE-2023-4506 | ldap-login-for-intranet-sites (WordPress plugin) | The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4. | low | 2.2 | 1% |
| CVE-2024-12857 | adforest (WordPress plugin) | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plug | critical | 9.8 | 1% |
| CVE-2024-7628 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to | high | 8.1 | 1% |
| CVE-2026-21446 | bagisto/bagisto | Bagisto Missing Authentication on Installer API Endpoints | critical | 9.8 | 1% |