Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6875 | post-smtp (WordPress plugin) | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unau | critical | 9.8 | 90% |
| CVE-2020-13700 | acf-to-rest-api (WordPress plugin), airesvsg/acf-to-rest-api | An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permali | high | 7.5 | 13% |
| CVE-2019-17574 | popup-maker (WordPress plugin) | An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the argumen | critical | 9.1 | 9% |
| CVE-2023-3219 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid E | medium | 5.3 | 8% |
| CVE-2020-29156 | woocommerce (WordPress plugin), woocommerce/woocommerce | The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter | medium | 5.3 | 4% |
| CVE-2019-20209 | citybook (WordPress plugin), easybook (WordPress plugin), townhub (WordPress plugin) | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Refere | high | 7.5 | 3% |
| CVE-2022-2034 | sensei-lms (WordPress plugin) | The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated user | medium | 5.3 | 3% |
| CVE-2014-0808 | ec-cube/ec-cube | EC-CUBE vulnerable to authorization bypass | medium | 5.3 | 2% |
| CVE-2021-36032 | magento/community-edition, magento/project-community-edition | Magento is affected by an improper input validation vulnerability | high | 8.8 | 2% |
| CVE-2023-3105 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is d | high | 8.8 | 2% |
| CVE-2021-21022 | magento/community-edition, magento/project-community-edition | Magento Insecure Direct Object Reference (IDOR) in the product module | medium | 5.3 | 2% |
| CVE-2020-6859 | ultimate-member (WordPress plugin) | Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for W | medium | 5.3 | 2% |
| CVE-2019-7950 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Access Control Bypass | high | 7.5 | 2% |
| CVE-2022-2535 | searchwp-live-ajax-search (WordPress plugin) | The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts o | medium | 5.3 | 2% |
| CVE-2021-24892 | advanced-forms (WordPress plugin) | Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change | high | 8.8 | 2% |
| CVE-2021-41129 | pterodactyl/panel | Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification | high | 8.1 | 2% |
| CVE-2022-3805 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in | high | 8.6 | 2% |
| CVE-2022-1165 | blackhole-for-bad-bots (WordPress plugin) | The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of | critical | 9.1 | 2% |
| CVE-2021-24562 | lifterlms (WordPress plugin) | The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an I | high | 7.5 | 2% |
| CVE-2022-1580 | site-offline (WordPress plugin) | The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so | medium | 4.3 | 2% |
| CVE-2021-41120 | sylius/paypal-plugin | Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS | high | 7.5 | 2% |
| CVE-2021-24374 | automattic/jetpack, jetpack (WordPress plugin) | JetPack Exposure of Resource to Wrong Sphere | medium | 5.3 | 1% |
| CVE-2019-16403 | bagisto/bagisto | Authorization Bypass Through User-Controlled Key in Bagisto | high | 8.8 | 1% |
| CVE-2022-42344 | magento/community-edition | Magento Improper input validation vulnerability | high | 8.8 | 1% |
| CVE-2025-47226 | snipe/snipe-it | Grokability Snipe-IT has incorrect authorization for accessing asset information | medium | 5.0 | 1% |
| CVE-2022-2367 | wsm-downloader (WordPress plugin) | The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed | high | 7.5 | 1% |
| CVE-2023-0865 | woocommerce-multiple-customer-addresses-\&-shipping (WordPress plugin) | The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/ | high | 8.8 | 1% |
| CVE-2022-1614 | wp-email (WordPress plugin) | The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes | high | 7.5 | 1% |
| CVE-2021-24840 | squaretype (WordPress plugin) | The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display | medium | 5.3 | 1% |
| CVE-2021-22967 | concrete5/core | Exposure of sensitive information in concrete5/core | medium | 0.0 | 1% |
| CVE-2019-7854 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition IDOR Vulnerability | high | 7.5 | 1% |
| CVE-2021-22951 | concrete5/core | Password exposure in concrete5/core | medium | 0.0 | 1% |
| CVE-2021-36874 | ulisting (WordPress plugin) | Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5). | high | 7.1 | 1% |
| CVE-2023-2276 | wc-multivendor-membership (WordPress plugin) | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Refer | critical | 9.8 | 1% |
| CVE-2022-0266 | remdex/livehelperchat | Authorization Bypass Through User-Controlled Key in LiveHelperChat | medium | 6.5 | 1% |
| CVE-2021-3992 | kevinpapst/kimai2 | kimai2 is vulnerable to Improper Access Control | medium | 6.5 | 1% |
| CVE-2021-25096 | country-blocker (WordPress plugin) | The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL | medium | 6.5 | 1% |
| CVE-2021-24739 | logo-carousel (WordPress plugin) | The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts | high | 8.1 | 1% |
| CVE-2021-24655 | wp-user-manager (WordPress plugin) | The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key give | high | 7.5 | 1% |
| CVE-2022-0731 | dolibarr/dolibarr | Improper Authorization in dolibarr/dolibarr | medium | 6.5 | 1% |
| CVE-2021-24318 | listeo (WordPress plugin) | The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allo | medium | 6.5 | 1% |
| CVE-2026-27823 | egroupware/egroupware | EGroupware has a Remote Code Execution Vulnerability | critical | 0.0 | 1% |
| CVE-2022-30852 | idno/known | Known v1.3.1 contains Insecure Direct Object Reference | medium | 4.3 | 1% |
| CVE-2026-40308 | joedolson/my-calendar | Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar | high | 0.0 | 1% |
| CVE-2023-38218 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | high | 8.8 | 1% |
| CVE-2019-7864 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition IDOR Vulnerability | medium | 5.3 | 1% |
| CVE-2023-0558 | contentstudio (WordPress plugin) | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type jugg | high | 8.2 | 1% |
| CVE-2019-7890 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition IDOR Vulnerability | high | 7.3 | 1% |
| CVE-2022-2080 | sensei-lms (WordPress plugin) | The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original send | medium | 4.3 | 1% |
| CVE-2021-3964 | elgg/elgg | elgg is vulnerable to Authorization Bypass Through User-Controlled Key | medium | 5.9 | 1% |