Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-1000207 | modx/revolution | MODX Revolution Incorrect Access Control vulnerability | high | 7.2 | 64% |
| CVE-2021-21809 | moodle/moodle | Moodle command execution vulnerability exists in the default legacy spellchecker plugin | critical | 9.1 | 24% |
| CVE-2017-6104 | zen-mobile-app-native (WordPress plugin) | Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. | high | 7.5 | 7% |
| CVE-2021-38557 | billz/raspap-webgui | raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. | high | 8.8 | 2% |
| CVE-2017-16754 | bolt/bolt | Bolt Improper Access Control | medium | 5.3 | 2% |
| CVE-2021-41170 | neoan3-apps/template | Insecure Inherited Permissions in neoan3-apps/template | high | 7.5 | 2% |
| CVE-2021-32717 | shopware/core, shopware/platform | Private files publicly accessible with Cloud Storage providers | high | 7.5 | 1% |
| CVE-2022-1412 | log-wp-mail (WordPress plugin) | The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any u | high | 7.5 | 1% |
| CVE-2022-28056 | shopxo/shopxo | Incorrect Permission Assignment for Critical Resource in ShopXO | critical | 9.8 | 1% |
| CVE-2018-12642 | froxlor/froxlor | Froxlor Incorrect Access Control | high | 7.5 | 1% |
| CVE-2015-9456 | orbisius-child-theme-creator (WordPress plugin) | The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin | medium | 6.5 | 1% |
| CVE-2019-12245 | silverstripe/assets, silverstripe/framework | Lack of access control on upoaded files | medium | 5.3 | 1% |
| CVE-2018-1000025 | kreait/firebase-php | Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability | high | 8.1 | 1% |
| CVE-2018-1000165 | lightsaml/lightsaml | LightSAML Incorrect Access Control vulnerability | high | 7.5 | 1% |
| CVE-2022-39284 | codeigniter4/framework | Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued | low | 2.6 | 1% |
| CVE-2022-0277 | microweber/microweber | Microweber Incorrect Permission Assignment for Critical Resource vulnerability | medium | 6.5 | 1% |
| CVE-2022-24872 | shopware/core, shopware/platform | Improper Access Control in Shopware | high | 8.1 | 1% |
| CVE-2017-6928 | drupal/core, drupal/drupal | Drupal access bypass vulnerability | medium | 5.3 | 1% |
| CVE-2017-11422 | statamic/cms | Statamic framework Incorrect Permission Assignment | high | 8.8 | 1% |
| CVE-2019-19915 | 301-redirects (WordPress plugin) | The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, del | critical | 9.0 | 1% |
| CVE-2022-42949 | silverstripe/subsites | SilverStripe Subsite weakens file permissions | medium | 5.4 | 1% |
| CVE-2024-12255 | accept-stripe-payments-using-contact-form-7 (WordPress plugin) | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |
| CVE-2026-59944 | composer/composer | Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path | medium | 6.1 | 0% |
| CVE-2023-6506 | wp-2fa (WordPress plugin) | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions | medium | 4.3 | 0% |
| CVE-2024-3668 | powerpack-addons-for-elementor (WordPress plugin) | The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. Th | high | 8.8 | 0% |
| CVE-2021-24703 | download-plugin (WordPress plugin) | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowin | medium | 5.7 | 0% |
| CVE-2023-48714 | silverstripe/framework | Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter | medium | 4.3 | 0% |
| CVE-2021-27908 | mautic/core | Mautic vulnerable to secret data exfiltration via symfony parameters | medium | 5.8 | 0% |
| CVE-2023-6883 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple A | medium | 4.3 | 0% |
| CVE-2023-5651 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package | medium | 5.4 | 0% |
| CVE-2024-58383 | froxlor/froxlor | Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD> | high | 7.3 | 0% |
| CVE-2026-59946 | composer/composer | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files | medium | 6.1 | 0% |