Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1329 | elementor (WordPress plugin) | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capabili | high | 8.8 | 93% |
| CVE-2023-6875 | post-smtp (WordPress plugin) | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unau | critical | 9.8 | 90% |
| CVE-2020-8772 | infinitewp-client (WordPress plugin) | The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker | critical | 9.8 | 88% |
| CVE-2019-19985 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user informat | medium | 5.3 | 71% |
| CVE-2022-0218 | wp-html-mail (WordPress plugin) | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme s | high | 8.3 | 66% |
| CVE-2024-1380 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the | medium | 5.3 | 50% |
| CVE-2023-2796 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthent | medium | 5.3 | 43% |
| CVE-2024-10728 | ultimate-post (WordPress plugin) | The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/acti | high | 8.8 | 39% |
| CVE-2024-3097 | nextgen-gallery (WordPress plugin) | The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability | medium | 5.3 | 38% |
| CVE-2024-0235 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unaut | medium | 5.3 | 38% |
| CVE-2021-24146 | modern-events-calendar-lite (WordPress plugin) | Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access t | high | 7.5 | 31% |
| CVE-2022-1020 | woo-product-table (WordPress plugin) | The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_adm | critical | 9.8 | 26% |
| CVE-2023-3124 | elementor-pro (WordPress plugin) | The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_ | high | 8.8 | 23% |
| CVE-2024-7856 | mp3-music-player-by-sonaar (WordPress plugin) | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file dele | high | 8.1 | 19% |
| CVE-2021-4374 | wordpress-automatic-plugin (WordPress plugin) | The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is du | critical | 9.1 | 16% |
| CVE-2024-10542 | cleantalk-spam-protect (WordPress plugin) | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due t | critical | 9.8 | 15% |
| CVE-2022-1574 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as | critical | 9.8 | 12% |
| CVE-2022-2552 | duplicator (WordPress plugin) | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such | medium | 5.3 | 12% |
| CVE-2022-0952 | sitemap (WordPress plugin) | The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, | high | 8.8 | 11% |
| CVE-2020-11514 | seo-by-rank-math (WordPress plugin) | The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, includin | critical | 9.8 | 11% |
| CVE-2022-0885 | member-hero (WordPress plugin) | The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, | critical | 9.8 | 9% |
| CVE-2024-9707 | hunk-companion (WordPress plugin) | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on th | critical | 9.8 | 9% |
| CVE-2020-10257 | addons (WordPress plugin), aldo-gutenberg-wordpress-blog-theme (WordPress plugin), amuli (WordPress plugin) +60 more | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allow | critical | 9.8 | 9% |
| CVE-2022-1442 | metform (WordPress plugin) | The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php | high | 7.5 | 9% |
| CVE-2022-1903 | armember (WordPress plugin) | The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization | high | 8.1 | 9% |
| CVE-2022-3124 | frontend-file-manager (WordPress plugin) | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermo | medium | 5.3 | 8% |
| CVE-2015-20067 | wp-attachment-export (WordPress plugin) | The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the | high | 7.5 | 8% |
| CVE-2021-25032 | capabilities (WordPress plugin) | The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have autho | critical | 9.8 | 7% |
| CVE-2020-28036 | WordPress core | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | critical | 9.8 | 5% |
| CVE-2022-2461 | transposh-translation-filter-for-wordpress (WordPress plugin) | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions | medium | 5.3 | 5% |
| CVE-2019-25141 | easy-wp-smtp (WordPress plugin) | The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing | critical | 9.8 | 4% |
| CVE-2020-36719 | listingpro (WordPress plugin) | The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivati | critical | 9.8 | 4% |
| CVE-2022-0236 | wp-import-export (WordPress plugin), wp-import-export-lite (WordPress plugin) | The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a m | high | 7.5 | 4% |
| CVE-2022-1054 | rsvp-and-event-management (WordPress plugin) | The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and ha | medium | 5.3 | 4% |
| CVE-2024-4898 | instawp-connect (WordPress plugin) | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authori | critical | 9.8 | 4% |
| CVE-2022-2379 | easy-student-results (WordPress plugin) | The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve info | high | 7.5 | 3% |
| CVE-2025-1562 | wp-marketing-automations (WordPress plugin) | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable | critical | 9.8 | 3% |
| CVE-2017-1002006 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecti | high | 7.5 | 3% |
| CVE-2017-1002007 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting | high | 7.5 | 3% |
| CVE-2020-11511 | learnpress (WordPress plugin) | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the a | high | 8.1 | 3% |
| CVE-2015-10143 | platform-theme (WordPress theme) | The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing c | critical | 9.8 | 3% |
| CVE-2021-24997 | wp-guppy (WordPress plugin) | The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them a | medium | 6.5 | 3% |
| CVE-2025-2075 | uncanny-automator (WordPress plugin) | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation | high | 8.8 | 3% |
| CVE-2022-2846 | calendar-event-multi-view (WordPress plugin) | The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event | medium | 4.3 | 3% |
| CVE-2024-7135 | tainacan (WordPress plugin) | The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_file' function | medium | 6.5 | 3% |
| CVE-2021-24356 | simple-301-redirects (WordPress plugin) | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJ | high | 8.8 | 3% |
| CVE-2020-9457 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vuln | high | 8.8 | 3% |
| CVE-2020-9456 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privilege | high | 8.8 | 3% |
| CVE-2020-9458 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privilege | high | 8.8 | 3% |
| CVE-2024-0324 | profile-builder (WordPress plugin) | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | high | 8.2 | 2% |