Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-34077 | mantisbt/mantisbt | Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process | high | 7.3 | 1% |
| CVE-2023-2297 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions | critical | 9.8 | 1% |
| CVE-2023-4214 | apppresser (WordPress plugin) | The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the | high | 8.1 | 1% |
| CVE-2023-2449 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the pl | critical | 9.8 | 1% |
| CVE-2026-54176 | backpack/crud | Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check | medium | 6.5 | 1% |
| CVE-2025-5482 | sunshine-photo-cart (WordPress plugin) | The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via accoun | high | 8.8 | 1% |
| CVE-2025-3603 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2. | critical | 9.8 | 1% |
| CVE-2023-5844 | pimcore/admin-ui-classic-bundle | pimcore/admin-ui-classic-bundle Unverified Password Change | medium | 4.3 | 1% |
| CVE-2026-54175 | backpack/crud | Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment | high | 7.6 | 1% |
| CVE-2024-12860 | carspot (WordPress plugin) | The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all ve | critical | 9.8 | 0% |
| CVE-2023-4915 | wp-user-control (WordPress plugin) | The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due t | medium | 5.3 | 0% |
| CVE-2024-8794 | ba-book-everything (WordPress plugin) | The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is | medium | 5.3 | 0% |
| CVE-2025-47938 | typo3/cms-core, typo3/cms-setup | TYPO3 Unverified Password Change for Backend Users | low | 3.8 | 0% |
| CVE-2025-67719 | ibexa/user | Ibexa User Bundle is missing password change validation | critical | 0.0 | 0% |
| GHSA-h4hf-v6w5-897x | poweradmin/poweradmin | Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account | high | 8.8 | – |