Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-31779 | yoast-seo-for-typo3/yoast_seo | Server-Side Request Forgery in yoast_seo | medium | 6.4 | 0% |
| CVE-2025-68437 | craftcms/cms | Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation | medium | 0.0 | 0% |
| CVE-2026-41887 | flarum/core | Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) | medium | 4.9 | 0% |
| CVE-2026-25492 | craftcms/craft | Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host | medium | 0.0 | 0% |
| CVE-2024-13907 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forg | medium | 4.9 | 0% |
| CVE-2026-27129 | craftcms/cms | Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution | medium | 0.0 | 0% |
| CVE-2026-31317 | markhuot/craftql | Craftql vulnerable to Server-Side Request Forgery | high | 7.5 | 0% |
| CVE-2026-33039 | wwbn/avideo | AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy | high | 8.6 | 0% |
| CVE-2024-1978 | friends (WordPress plugin) | The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the discover_a | medium | 5.5 | 0% |
| CVE-2023-46725 | foodcoopshop/foodcoopshop | FoodCoopShop Server-Side Request Forgery vulnerability | high | 8.1 | 0% |
| CVE-2023-3025 | dropbox-folder-share (WordPress plugin) | The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the ' | high | 7.2 | 0% |
| CVE-2026-33502 | wwbn/avideo | AVideo has Unauthenticated SSRF via plugin/Live/test.php | critical | 9.3 | 0% |
| CVE-2024-25737 | vufind/vufind | VuFind Server-Side Request Forgery (SSRF) vulnerability | critical | 9.1 | 0% |
| CVE-2023-23684 | wp-graphql/wp-graphql | WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF) | medium | 6.5 | 0% |
| CVE-2022-25777 | mautic/core | Mautic: MST-48 Server-Side Request Forgery in Asset section | medium | 6.5 | 0% |
| CVE-2023-34013 | poll-maker (WordPress plugin) | Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – | medium | 4.4 | 0% |
| CVE-2026-33351 | wwbn/avideo | AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass | critical | 9.1 | 0% |
| CVE-2026-32812 | admidio/admidio | Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint | medium | 6.8 | 0% |
| CVE-2024-1855 | wp-cafe (WordPress plugin) | The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to | medium | 5.3 | 0% |
| CVE-2024-13924 | starter-templates (WordPress plugin) | The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and includin | medium | 5.3 | 0% |
| CVE-2026-50281 | craftcms/cms | Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements | high | 0.0 | 0% |
| CVE-2026-33182 | saloonphp/saloon | Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL | medium | 0.0 | 0% |
| CVE-2026-54494 | phanan/koel | Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv | medium | 0.0 | 0% |
| CVE-2026-28423 | statamic/cms | Statamic Vulnerable to Server-Side Request Forgery via Glide | medium | 6.8 | 0% |
| CVE-2026-49359 | pontedilana/php-weasyprint | PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option | medium | 6.5 | 0% |
| CVE-2024-13904 | platformly-for-woocommerce (WordPress plugin) | The Platform.ly for WooCommerce plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including | medium | 5.3 | 0% |
| CVE-2025-1970 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inclu | high | 7.6 | 0% |
| CVE-2026-54493 | phanan/koel | Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations | high | 7.7 | 0% |
| CVE-2026-44583 | paymenter/paymenter | Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module | medium | 5.3 | 0% |
| CVE-2026-54492 | phanan/koel | Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation | medium | 4.3 | 0% |
| CVE-2024-6522 | modern-events-calendar (WordPress plugin), modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 vi | high | 8.5 | 0% |
| CVE-2026-25493 | craftcms/cms | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect | medium | 0.0 | 0% |
| CVE-2026-25494 | craftcms/cms | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation | medium | 0.0 | 0% |
| CVE-2024-3047 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and in | high | 7.2 | 0% |
| CVE-2023-41804 | starter-templates (WordPress plugin) | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.Thi | high | 7.1 | 0% |
| CVE-2024-13450 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | low | 3.8 | 0% |
| CVE-2025-2109 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions | medium | 5.8 | 0% |
| CVE-2026-6366 | drupal/core | Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists | medium | 6.6 | 0% |
| CVE-2026-33486 | roadiz/documents | Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents | medium | 6.8 | 0% |
| CVE-2024-13923 | order-import-export-for-woocommerce (WordPress plugin) | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and | high | 7.6 | 0% |
| CVE-2026-35540 | roundcube/roundcubemail | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages | medium | 5.4 | 0% |
| CVE-2023-4893 | crayon-syntax-highlighter (WordPress plugin) | The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to | medium | 6.4 | 0% |
| CVE-2026-54491 | phanan/koel | Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths | high | 7.1 | 0% |
| CVE-2026-84189 | librenms/librenms | LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page | high | 8.1 | 0% |
| CVE-2025-1912 | product-import-export-for-woo (WordPress plugin) | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forger | high | 7.6 | 0% |
| CVE-2026-41055 | wwbn/avideo | WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF | medium | 5.3 | 0% |
| CVE-2024-13905 | onestore-sites (WordPress plugin) | The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the cla | medium | 5.3 | 0% |
| CVE-2026-69246 | guzzlehttp/guzzle | Guzzle: Noncanonical host can bypass host-based checks | high | 7.2 | 0% |
| CVE-2024-4354 | tablepress (WordPress plugin) | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-10903 | broken-link-checker (WordPress plugin) | The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow a | medium | 4.7 | 0% |