Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-45291 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled | medium | 6.3 | 1% |
| CVE-2023-26366 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 6.8 | 1% |
| CVE-2021-22969 | concrete5/core | Server-Side Request Forgery in Concrete CMS | medium | 0.0 | 1% |
| CVE-2019-3809 | moodle/moodle | Moodle Blind SSRF Risk in /badges/mybackpack.php | critical | 10.0 | 1% |
| CVE-2024-55637 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2023-35133 | moodle/moodle | Moodle vulnerable to Server Side Request Forgery | high | 7.5 | 1% |
| CVE-2025-54370 | phpoffice/phpspreadsheet | PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser | high | 0.0 | 1% |
| CVE-2023-6294 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with th | high | 7.2 | 1% |
| CVE-2021-33563 | phanan/koel | Improper rate limiting in Koel | high | 0.0 | 1% |
| CVE-2026-72778 | craftcms/cms | Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass | high | 0.0 | 1% |
| CVE-2022-2556 | mailchimp-for-woocommerce (WordPress plugin) | The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on | low | 2.7 | 1% |
| CVE-2023-3958 | wp-remote-users-sync (WordPress plugin) | The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in ver | high | 8.5 | 1% |
| CVE-2022-2267 | mailchimp-for-woocommerce (WordPress plugin) | The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perfo | medium | 4.3 | 1% |
| CVE-2025-6851 | broken-link-notifier (WordPress plugin) | The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via t | high | 7.2 | 1% |
| CVE-2026-34084 | phpoffice/phpspreadsheet | PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled | critical | 0.0 | 1% |
| CVE-2023-7037 | automad/automad | Authenticated Blind SSRF in automad/automad | low | 3.7 | 1% |
| CVE-2017-20157 | arc/web | Ariadne Component Library vulnerable to Server-Side Request Forgery | critical | 9.8 | 1% |
| CVE-2023-6991 | jsm-file-get-contents\(\)-shortcode (WordPress plugin) | The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a requ | high | 8.8 | 1% |
| CVE-2026-27591 | winter/wn-backend-module | Winter vulnerable to privilege escalation by authenticated backend users | critical | 9.9 | 1% |
| CVE-2024-25738 | vufind/vufind | VuFind Server-Side Request Forgery (SSRF) vulnerability | critical | 9.1 | 1% |
| CVE-2022-2912 | craw-data (WordPress plugin) | The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change t | medium | 4.3 | 1% |
| CVE-2026-28508 | idno/known | Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint | critical | 0.0 | 1% |
| CVE-2024-47049 | czim/file-handling | czim/file-handling vulnerable to SSRF and directory traversal | high | 8.2 | 1% |
| CVE-2023-1971 | yuan1994/tpadmin | yuan1994 tpAdmin vulnerable to Server-Side Request Forgery | medium | 4.9 | 1% |
| CVE-2024-45290 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file | high | 7.7 | 1% |
| CVE-2022-42494 | all-in-one-seo (WordPress plugin) | Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress. | low | 3.0 | 1% |
| CVE-2023-1895 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint | high | 8.5 | 1% |
| CVE-2022-41609 | bp-better-messages (WordPress plugin) | Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress. | medium | 6.4 | 1% |
| CVE-2025-31674 | drupal/core | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | medium | 0.0 | 1% |
| CVE-2024-4469 | wp-staging (WordPress plugin) | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conduc | high | 7.5 | 1% |
| CVE-2022-1213 | remdex/livehelperchat | Server side request forgery in LiveHelperChat | high | 7.7 | 1% |
| CVE-2026-62993 | smarty/smarty | Smarty: SSRF via redirect bypass of trusted_uri using {fetch} | medium | 0.0 | 1% |
| CVE-2026-48736 | symfony/http-client, symfony/http-foundation, symfony/symfony | Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpCli | medium | 0.0 | 1% |
| CVE-2023-7253 | import-wp (WordPress plugin) | The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which | medium | 6.1 | 1% |
| CVE-2022-1235 | remdex/livehelperchat | Weak password hash in LiveHelperChat | high | 7.5 | 1% |
| CVE-2026-81889 | studio-42/elfinder | elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback | high | 8.6 | 1% |
| CVE-2024-23825 | tablepress (WordPress plugin) | TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by | low | 3.0 | 1% |
| CVE-2022-23504 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration | medium | 5.7 | 1% |
| CVE-2024-4260 | coblocks (WordPress plugin) | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortc | medium | 6.5 | 1% |
| CVE-2024-1812 | everest-forms (WordPress plugin) | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'fon | high | 7.2 | 1% |
| CVE-2024-1758 | woocommerce-superfaktura (WordPress plugin) | The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 | medium | 5.4 | 1% |
| CVE-2021-36403 | moodle/moodle | Moodle has a Hidden Functionality vulnerability | medium | 5.3 | 1% |
| CVE-2024-2343 | avada (WordPress theme) | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up | medium | 6.4 | 1% |
| CVE-2023-27580 | codeigniter4/shield | Password Shucking Vulnerability | medium | 5.9 | 1% |
| CVE-2026-76086 | verbb/formie | Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials | high | 8.5 | 1% |
| CVE-2023-40033 | flarum/core, flarum/framework | Flarum vulnerable to LFI and Blind SSRF via Avatar upload | high | 7.1 | 1% |
| CVE-2026-52769 | yeswiki/yeswiki | YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` | high | 8.3 | 0% |
| CVE-2024-6524 | shopxo/shopxo | ShopXO Server-Side Request Forgery Vulnerability | medium | 5.5 | 0% |
| CVE-2025-15602 | snipe/snipe-it | Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment | high | 8.8 | 0% |
| CVE-2026-59931 | phpoffice/phpspreadsheet | PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist | high | 7.7 | 0% |