Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.3, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-1000419 | phpbb/phpbb | phpBB Server-Side Request Forgery (SSRF) | high | 7.5 | 1% |
| CVE-2020-13970 | shopware/platform | Shopware vulnerable to SSRF | high | 8.8 | 1% |
| CVE-2024-34111 | magento/community-edition | Magento Open Source Server-Side Request Forgery (SSRF) vulnerability | medium | 6.5 | 1% |
| CVE-2021-22958 | concrete5/concrete5 | Server-Side Request Forgery vulnerability in concrete5 | high | 8.2 | 1% |
| CVE-2022-24980 | kitodo/presentation | SSRF in Kitodo.Presentation | high | 7.5 | 1% |
| CVE-2013-6919 | james-heinrich/phpthumb | phpThumb is vulnerable to Server-Side Request Forgery (SSRF) | medium | 0.0 | 1% |
| CVE-2012-10018 | mapplic (WordPress plugin) | The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 r | high | 8.3 | 1% |
| CVE-2019-11767 | phpbb/phpbb | phpBB Server side request forgery (SSRF) | medium | 5.8 | 1% |
| CVE-2021-30108 | feehi/cms | Server-Side Request Forgery in Feehi CMS | critical | 9.1 | 1% |
| CVE-2019-6257 | studio-42/elfinder | elFinder Server Side Request Forgery (SSRF) | high | 7.7 | 1% |
| CVE-2023-29291 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 4.9 | 1% |
| CVE-2022-3708 | web-stories (WordPress plugin) | The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficien | critical | 9.6 | 1% |
| CVE-2022-35651 | moodle/moodle | Moodle Stored XSS and blind SSRF possible via SCORM track details | medium | 6.1 | 1% |
| CVE-2022-24871 | shopware/core, shopware/platform | Server-Side Request Forgery (SSRF) in Shopware | high | 7.2 | 1% |
| CVE-2021-37711 | shopware/core, shopware/platform | Authenticated server-side request forgery in file upload via URL. | high | 8.8 | 1% |
| CVE-2021-27312 | gleez/cms | Gleez Cms Server Side Request Forgery (SSRF) vulnerability | critical | 9.0 | 1% |
| CVE-2021-24371 | rsvpmaker (WordPress plugin) | The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and | low | 2.7 | 1% |
| CVE-2022-40700 | admin-css-mu (WordPress plugin), amo-for-wp---membership-management (WordPress plugin), amp-toolbox (WordPress plugin) +12 more | Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership | high | 8.2 | 1% |
| CVE-2022-0085 | dompdf/dompdf | Server-Side Request Forgery in dompdf/dompdf | medium | 5.3 | 1% |
| CVE-2022-36376 | rankmath/seo-by-rank-math, seo (WordPress plugin) | Rank Math SEO plugin vulnerable to Server-Side Request Forgery | critical | 9.8 | 1% |
| CVE-2020-8226 | phpbb/phpbb | phpBB Server-Side Request Forgery Vulnerability | medium | 5.8 | 1% |
| CVE-2017-16870 | updraftplus (WordPress plugin) | The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin. | high | 8.1 | 1% |
| CVE-2023-29292 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 4.9 | 1% |
| CVE-2020-24141 | wp-downloadmanager (WordPress plugin) | Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end s | medium | 5.3 | 1% |
| CVE-2021-4075 | snipe/snipe-it | Server-Side Request Forgery in snipe/snipe-it | high | 7.2 | 1% |
| CVE-2022-24739 | rudloff/alltube | Server-Side Request Forgery and Open Redirect in AllTube Download | high | 7.3 | 1% |
| CVE-2022-3247 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does n | medium | 6.5 | 1% |
| CVE-2024-45119 | magento/community-edition | Magento Open Source Server-Side Request Forgery (SSRF) vulnerability | medium | 4.9 | 1% |
| CVE-2024-45291 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled | medium | 6.3 | 1% |
| CVE-2023-26366 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 6.8 | 1% |
| CVE-2021-22969 | concrete5/core | Server-Side Request Forgery in Concrete CMS | medium | 0.0 | 1% |
| CVE-2019-3809 | moodle/moodle | Moodle Blind SSRF Risk in /badges/mybackpack.php | critical | 10.0 | 1% |
| CVE-2023-35133 | moodle/moodle | Moodle vulnerable to Server Side Request Forgery | high | 7.5 | 1% |
| CVE-2025-54370 | phpoffice/phpspreadsheet | PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser | high | 0.0 | 1% |
| CVE-2023-6294 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with th | high | 7.2 | 1% |
| CVE-2022-2556 | mailchimp-for-woocommerce (WordPress plugin) | The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on | low | 2.7 | 1% |
| CVE-2023-3958 | wp-remote-users-sync (WordPress plugin) | The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in ver | high | 8.5 | 1% |
| CVE-2022-2267 | mailchimp-for-woocommerce (WordPress plugin) | The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perfo | medium | 4.3 | 1% |
| CVE-2025-6851 | broken-link-notifier (WordPress plugin) | The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via t | high | 7.2 | 1% |
| CVE-2026-34084 | phpoffice/phpspreadsheet | PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled | critical | 0.0 | 1% |
| CVE-2023-7037 | automad/automad | Authenticated Blind SSRF in automad/automad | low | 3.7 | 1% |
| CVE-2017-20157 | arc/web | Ariadne Component Library vulnerable to Server-Side Request Forgery | critical | 9.8 | 1% |
| CVE-2023-6991 | jsm-file-get-contents\(\)-shortcode (WordPress plugin) | The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a requ | high | 8.8 | 1% |
| CVE-2024-25738 | vufind/vufind | VuFind Server-Side Request Forgery (SSRF) vulnerability | critical | 9.1 | 1% |
| CVE-2022-2912 | craw-data (WordPress plugin) | The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change t | medium | 4.3 | 1% |
| CVE-2026-28508 | idno/known | Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint | critical | 0.0 | 1% |
| CVE-2024-47049 | czim/file-handling | czim/file-handling vulnerable to SSRF and directory traversal | high | 8.2 | 1% |
| CVE-2023-1971 | yuan1994/tpadmin | yuan1994 tpAdmin vulnerable to Server-Side Request Forgery | medium | 4.9 | 1% |
| CVE-2024-45290 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file | high | 7.7 | 1% |
| CVE-2022-42494 | all-in-one-seo (WordPress plugin) | Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress. | low | 3.0 | 1% |