Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1329 | elementor (WordPress plugin) | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capabili | high | 8.8 | 93% |
| CVE-2023-6875 | post-smtp (WordPress plugin) | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unau | critical | 9.8 | 90% |
| CVE-2020-8772 | infinitewp-client (WordPress plugin) | The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker | critical | 9.8 | 88% |
| CVE-2021-24917 | wps-hide-login (WordPress plugin) | The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and | high | 7.5 | 72% |
| CVE-2019-19985 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user informat | medium | 5.3 | 71% |
| CVE-2022-0218 | wp-html-mail (WordPress plugin) | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme s | high | 8.3 | 66% |
| CVE-2024-1380 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the | medium | 5.3 | 50% |
| CVE-2022-0482 | alextselegidis/easyappointments | Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments | critical | 9.1 | 44% |
| CVE-2023-2796 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthent | medium | 5.3 | 43% |
| CVE-2024-10728 | ultimate-post (WordPress plugin) | The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/acti | high | 8.8 | 39% |
| CVE-2024-3097 | nextgen-gallery (WordPress plugin) | The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability | medium | 5.3 | 38% |
| CVE-2024-0235 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unaut | medium | 5.3 | 38% |
| CVE-2021-24146 | modern-events-calendar-lite (WordPress plugin) | Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access t | high | 7.5 | 31% |
| CVE-2022-1020 | woo-product-table (WordPress plugin) | The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_adm | critical | 9.8 | 26% |
| CVE-2020-35948 | xcloner (WordPress plugin) | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to | critical | 9.9 | 25% |
| CVE-2023-3124 | elementor-pro (WordPress plugin) | The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_ | high | 8.8 | 23% |
| CVE-2021-39341 | optinmonster (WordPress plugin) | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient aut | high | 8.2 | 22% |
| CVE-2024-7856 | mp3-music-player-by-sonaar (WordPress plugin) | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file dele | high | 8.1 | 19% |
| CVE-2025-24434 | magento/community-edition, magento/project-community-edition | Improper Authorization vulnerability in Magento and Adobe Commerce | critical | 9.1 | 17% |
| CVE-2021-4374 | wordpress-automatic-plugin (WordPress plugin) | The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is du | critical | 9.1 | 16% |
| CVE-2020-14321 | moodle/moodle | Moodle Incorrect Authorization vulnerability | high | 8.8 | 16% |
| CVE-2024-10542 | cleantalk-spam-protect (WordPress plugin) | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due t | critical | 9.8 | 15% |
| CVE-2021-21389 | buddypress (WordPress plugin), buddypress/buddypress | BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for | high | 8.1 | 15% |
| CVE-2022-1574 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as | critical | 9.8 | 12% |
| CVE-2022-2552 | duplicator (WordPress plugin) | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such | medium | 5.3 | 12% |
| CVE-2022-0952 | sitemap (WordPress plugin) | The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, | high | 8.8 | 11% |
| CVE-2020-11514 | seo-by-rank-math (WordPress plugin) | The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, includin | critical | 9.8 | 11% |
| CVE-2021-24405 | easy-cookies-policy (WordPress plugin) | The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authe | medium | 6.5 | 11% |
| CVE-2022-0885 | member-hero (WordPress plugin) | The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, | critical | 9.8 | 9% |
| CVE-2026-32267 | craftcms/cms | Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() | high | 0.0 | 9% |
| CVE-2024-9707 | hunk-companion (WordPress plugin) | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on th | critical | 9.8 | 9% |
| CVE-2020-10257 | addons (WordPress plugin), aldo-gutenberg-wordpress-blog-theme (WordPress plugin), amuli (WordPress plugin) +60 more | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allow | critical | 9.8 | 9% |
| CVE-2022-1631 | microweber/microweber | Incorrect Authorization in microweber | high | 8.8 | 9% |
| CVE-2022-1442 | metform (WordPress plugin) | The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php | high | 7.5 | 9% |
| CVE-2022-1903 | armember (WordPress plugin) | The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization | high | 8.1 | 9% |
| CVE-2022-3124 | frontend-file-manager (WordPress plugin) | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermo | medium | 5.3 | 8% |
| CVE-2015-20067 | wp-attachment-export (WordPress plugin) | The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the | high | 7.5 | 8% |
| CVE-2021-24278 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retri | high | 7.5 | 7% |
| CVE-2021-25032 | capabilities (WordPress plugin) | The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have autho | critical | 9.8 | 7% |
| CVE-2020-28036 | WordPress core | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | critical | 9.8 | 5% |
| CVE-2020-9587 | magento/community-edition, magento/core, magento/project-community-edition | Magento authorization bypass vulnerability | high | 7.5 | 5% |
| CVE-2022-2461 | transposh-translation-filter-for-wordpress (WordPress plugin) | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions | medium | 5.3 | 5% |
| CVE-2019-25141 | easy-wp-smtp (WordPress plugin) | The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing | critical | 9.8 | 4% |
| CVE-2020-36719 | listingpro (WordPress plugin) | The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivati | critical | 9.8 | 4% |
| CVE-2022-0236 | wp-import-export (WordPress plugin), wp-import-export-lite (WordPress plugin) | The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a m | high | 7.5 | 4% |
| CVE-2022-1054 | rsvp-and-event-management (WordPress plugin) | The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and ha | medium | 5.3 | 4% |
| CVE-2024-4898 | instawp-connect (WordPress plugin) | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authori | critical | 9.8 | 4% |
| CVE-2020-29156 | woocommerce (WordPress plugin), woocommerce/woocommerce | The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter | medium | 5.3 | 4% |
| CVE-2020-9692 | magento/community-edition | Magento security mitigation bypass vulnerability | medium | 6.5 | 4% |
| CVE-2023-23924 | dompdf/dompdf | Dompdf vulnerable to URI validation failure on SVG parsing | critical | 10.0 | 4% |