Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-53929 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ contains a CSV injection vulnerability | high | 8.8 | 1% |
| CVE-2023-5424 | ws-form (WordPress plugin) | The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated | medium | 4.7 | 0% |
| CVE-2023-5527 | business-directory-plugin (WordPress plugin) | The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv- | high | 7.4 | 0% |
| CVE-2023-3302 | admidio/admidio | Admidio Improper Neutralization of Formula Elements in a CSV File vulnerability | high | 7.3 | 0% |
| CVE-2026-55452 | snipe/snipe-it | Snipe-IT has CSV formula injection in Activity Report export | medium | 0.0 | 0% |
| CVE-2023-2629 | pimcore/customer-management-framework-bundle | Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection | high | 7.8 | 0% |
| CVE-2025-62417 | bagisto/bagisto | bagisto has CSV Formula Injection in Create New Product | critical | 9.0 | 0% |
| CVE-2026-47693 | poweradmin/poweradmin | Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications | medium | 6.9 | 0% |
| CVE-2026-54243 | statamic/cms | Statamic Vulnerable to CSV formula injection in form submission exports | medium | 6.1 | 0% |
| CVE-2025-67851 | moodle/moodle | Moodle formula injection vulnerability | medium | 6.1 | 0% |
| CVE-2026-42267 | kimai/kimai | Kimai vulnerable to formula Injection via tag names in XLSX export | medium | 5.7 | 0% |
| CVE-2026-45263 | facturascripts/facturascripts | FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens th | high | 8.0 | – |