Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24917 | wps-hide-login (WordPress plugin) | The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and | high | 7.5 | 72% |
| CVE-2022-0482 | alextselegidis/easyappointments | Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments | critical | 9.1 | 44% |
| CVE-2020-35948 | xcloner (WordPress plugin) | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to | critical | 9.9 | 25% |
| CVE-2021-39341 | optinmonster (WordPress plugin) | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient aut | high | 8.2 | 22% |
| CVE-2025-24434 | magento/community-edition, magento/project-community-edition | Improper Authorization vulnerability in Magento and Adobe Commerce | critical | 9.1 | 17% |
| CVE-2020-14321 | moodle/moodle | Moodle Incorrect Authorization vulnerability | high | 8.8 | 16% |
| CVE-2021-21389 | buddypress (WordPress plugin), buddypress/buddypress | BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for | high | 8.1 | 15% |
| CVE-2021-24405 | easy-cookies-policy (WordPress plugin) | The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authe | medium | 6.5 | 11% |
| CVE-2026-32267 | craftcms/cms | Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() | high | 0.0 | 9% |
| CVE-2022-1631 | microweber/microweber | Incorrect Authorization in microweber | high | 8.8 | 9% |
| CVE-2021-24278 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retri | high | 7.5 | 7% |
| CVE-2020-9587 | magento/community-edition, magento/core, magento/project-community-edition | Magento authorization bypass vulnerability | high | 7.5 | 5% |
| CVE-2020-29156 | woocommerce (WordPress plugin), woocommerce/woocommerce | The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter | medium | 5.3 | 4% |
| CVE-2020-9692 | magento/community-edition | Magento security mitigation bypass vulnerability | medium | 6.5 | 4% |
| CVE-2023-23924 | dompdf/dompdf | Dompdf vulnerable to URI validation failure on SVG parsing | critical | 10.0 | 4% |
| CVE-2018-20147 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. | medium | 6.5 | 3% |
| CVE-2021-24947 | responsive-vector-maps (WordPress plugin) | The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path par | medium | 6.5 | 3% |
| CVE-2017-6816 | WordPress core | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. | medium | 4.9 | 3% |
| CVE-2020-24401 | magento/community-edition, magento/project-community-edition | Magento 2 Community Edition Incorrect Authorization | medium | 6.5 | 2% |
| CVE-2022-34255 | magento/community-edition | Magento Improper Access Control vulnerability | high | 8.8 | 2% |
| CVE-2022-0594 | shareaholic (WordPress plugin) | The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one | medium | 5.3 | 2% |
| CVE-2022-34256 | magento/community-edition | Magento Improper Authorization vulnerability | high | 7.5 | 2% |
| CVE-2022-0633 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to | medium | 6.5 | 2% |
| CVE-2021-39321 | sassy-social-share (WordPress plugin) | Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJ | high | 8.8 | 2% |
| CVE-2022-31042 | guzzlehttp/guzzle, drupal/core | Failure to strip the Cookie header on change in host or HTTP downgrade | high | 7.5 | 2% |
| CVE-2020-12669 | dolibarr/dolibarr | Incorrect Authorization in Dolibarr | high | 8.8 | 2% |
| CVE-2017-6377 | drupal/core, drupal/drupal | Drupal editor module incorrectly checks access to inline private files | high | 7.5 | 2% |
| CVE-2020-12477 | nilsteampassnet/teampass | Incorrect Authorization in TeamPass | high | 7.5 | 2% |
| CVE-2021-36037 | magento/community-edition, magento/project-community-edition | Magento is affected by an improper authorization vulnerability | medium | 6.5 | 2% |
| CVE-2021-38299 | web-auth/webauthn-framework | Improper Access Control in Webauthn Framework | critical | 9.8 | 2% |
| CVE-2023-6036 | web3---crypto-wallet-login-\&-nft-token-gating (WordPress plugin) | The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow | critical | 9.8 | 2% |
| CVE-2021-36039 | magento/community-edition, magento/project-community-edition | Magento discloses sensitive information | medium | 6.5 | 2% |
| CVE-2020-15246 | october/cms | Local File Inclusion by unauthenticated users | high | 7.5 | 2% |
| CVE-2021-23803 | latte/latte | Incorrect Authorization in latte/latte | critical | 9.8 | 2% |
| CVE-2020-35849 | mantisbt/mantisbt | MantisBT Incorrect Authorization for bug_revision_view_page.php check | high | 7.5 | 2% |
| CVE-2020-25699 | moodle/moodle | Privilage Escalation in moodle | high | 7.5 | 2% |
| CVE-2011-4297 | moodle/moodle | Moodle does not properly restrict comment capabilities | medium | 0.0 | 2% |
| CVE-2024-5324 | login\/signup-popup (WordPress plugin), otp-login-woocommerce-\&-gravity-forms (WordPress plugin), side-cart-woocommerce (WordPress plugin) +1 more | Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capabilit | high | 8.8 | 2% |
| CVE-2022-0920 | salon-booking-system (WordPress plugin) | The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could | high | 7.5 | 1% |
| CVE-2020-25701 | moodle/moodle | Privilage Escalation in moodle | medium | 5.3 | 1% |
| CVE-2021-20281 | moodle/moodle | Moodle allowed some users without permission to view other users' full names | medium | 5.3 | 1% |
| CVE-2021-38312 | gutenberg-template-library-\&-redux-framework (WordPress plugin) | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoi | high | 7.1 | 1% |
| CVE-2021-24717 | automatorwp (WordPress plugin) | The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate autom | high | 8.8 | 1% |
| CVE-2021-20841 | ec-cube/ec-cube | EC-CUBE Improper access control in Management screen | medium | 6.5 | 1% |
| CVE-2022-42344 | magento/community-edition | Magento Improper input validation vulnerability | high | 8.8 | 1% |
| CVE-2021-20282 | moodle/moodle | Moodle Bypass email verification secret when confirming account registration | medium | 5.3 | 1% |
| CVE-2022-2354 | wp-dbmanager (WordPress plugin) | The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite i | high | 7.2 | 1% |
| CVE-2020-13665 | drupal/core, drupal/drupal, drupal/core | Drupal Core Access bypass vulnerability | critical | 9.8 | 1% |
| CVE-2024-2473 | wps-hide-login (WordPress plugin) | The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due t | medium | 5.3 | 1% |
| CVE-2020-13677 | drupal/core | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which ma | high | 7.5 | 1% |