Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-1895 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint | high | 8.5 | 1% |
| CVE-2022-41609 | bp-better-messages (WordPress plugin) | Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress. | medium | 6.4 | 1% |
| CVE-2024-4469 | wp-staging (WordPress plugin) | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conduc | high | 7.5 | 1% |
| CVE-2022-1213 | remdex/livehelperchat | Server side request forgery in LiveHelperChat | high | 7.7 | 1% |
| CVE-2026-62993 | smarty/smarty | Smarty: SSRF via redirect bypass of trusted_uri using {fetch} | medium | 0.0 | 1% |
| CVE-2026-48736 | symfony/http-client, symfony/http-foundation, symfony/symfony | Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpCli | medium | 0.0 | 1% |
| CVE-2023-7253 | import-wp (WordPress plugin) | The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which | medium | 6.1 | 1% |
| CVE-2026-81889 | studio-42/elfinder | elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback | high | 8.6 | 1% |
| CVE-2024-23825 | tablepress (WordPress plugin) | TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by | low | 3.0 | 1% |
| CVE-2024-4260 | coblocks (WordPress plugin) | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortc | medium | 6.5 | 1% |
| CVE-2024-1812 | everest-forms (WordPress plugin) | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'fon | high | 7.2 | 1% |
| CVE-2024-1758 | woocommerce-superfaktura (WordPress plugin) | The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 | medium | 5.4 | 1% |
| CVE-2024-2343 | avada (WordPress theme) | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up | medium | 6.4 | 1% |
| CVE-2026-76086 | verbb/formie | Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials | high | 8.5 | 1% |
| CVE-2023-40033 | flarum/core, flarum/framework | Flarum vulnerable to LFI and Blind SSRF via Avatar upload | high | 7.1 | 1% |
| CVE-2026-52769 | yeswiki/yeswiki | YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` | high | 8.3 | 0% |
| CVE-2024-6524 | shopxo/shopxo | ShopXO Server-Side Request Forgery Vulnerability | medium | 5.5 | 0% |
| CVE-2026-59931 | phpoffice/phpspreadsheet | PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist | high | 7.7 | 0% |
| CVE-2021-31779 | yoast-seo-for-typo3/yoast_seo | Server-Side Request Forgery in yoast_seo | medium | 6.4 | 0% |
| CVE-2025-68437 | craftcms/cms | Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation | medium | 0.0 | 0% |
| CVE-2026-41887 | flarum/core | Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) | medium | 4.9 | 0% |
| CVE-2026-25492 | craftcms/craft | Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host | medium | 0.0 | 0% |
| CVE-2024-13907 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forg | medium | 4.9 | 0% |
| CVE-2026-27129 | craftcms/cms | Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution | medium | 0.0 | 0% |
| CVE-2026-31317 | markhuot/craftql | Craftql vulnerable to Server-Side Request Forgery | high | 7.5 | 0% |
| CVE-2026-33039 | wwbn/avideo | AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy | high | 8.6 | 0% |
| CVE-2024-1978 | friends (WordPress plugin) | The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the discover_a | medium | 5.5 | 0% |
| CVE-2023-46725 | foodcoopshop/foodcoopshop | FoodCoopShop Server-Side Request Forgery vulnerability | high | 8.1 | 0% |
| CVE-2023-3025 | dropbox-folder-share (WordPress plugin) | The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the ' | high | 7.2 | 0% |
| CVE-2026-33502 | wwbn/avideo | AVideo has Unauthenticated SSRF via plugin/Live/test.php | critical | 9.3 | 0% |
| CVE-2024-25737 | vufind/vufind | VuFind Server-Side Request Forgery (SSRF) vulnerability | critical | 9.1 | 0% |
| CVE-2023-23684 | wp-graphql/wp-graphql | WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF) | medium | 6.5 | 0% |
| CVE-2022-25777 | mautic/core | Mautic: MST-48 Server-Side Request Forgery in Asset section | medium | 6.5 | 0% |
| CVE-2023-34013 | poll-maker (WordPress plugin) | Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – | medium | 4.4 | 0% |
| CVE-2026-33351 | wwbn/avideo | AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass | critical | 9.1 | 0% |
| CVE-2026-32812 | admidio/admidio | Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint | medium | 6.8 | 0% |
| CVE-2024-1855 | wp-cafe (WordPress plugin) | The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to | medium | 5.3 | 0% |
| CVE-2024-13924 | starter-templates (WordPress plugin) | The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and includin | medium | 5.3 | 0% |
| CVE-2026-33182 | saloonphp/saloon | Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL | medium | 0.0 | 0% |
| CVE-2026-54494 | phanan/koel | Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv | medium | 0.0 | 0% |
| CVE-2026-28423 | statamic/cms | Statamic Vulnerable to Server-Side Request Forgery via Glide | medium | 6.8 | 0% |
| CVE-2026-49359 | pontedilana/php-weasyprint | PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option | medium | 6.5 | 0% |
| CVE-2024-13904 | platformly-for-woocommerce (WordPress plugin) | The Platform.ly for WooCommerce plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including | medium | 5.3 | 0% |
| CVE-2025-1970 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inclu | high | 7.6 | 0% |
| CVE-2026-54493 | phanan/koel | Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations | high | 7.7 | 0% |
| CVE-2026-44583 | paymenter/paymenter | Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module | medium | 5.3 | 0% |
| CVE-2026-54492 | phanan/koel | Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation | medium | 4.3 | 0% |
| CVE-2024-6522 | modern-events-calendar (WordPress plugin), modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 vi | high | 8.5 | 0% |
| CVE-2026-25493 | craftcms/cms | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect | medium | 0.0 | 0% |
| CVE-2026-25494 | craftcms/cms | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation | medium | 0.0 | 0% |