Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3047 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and in | high | 7.2 | 0% |
| CVE-2023-41804 | starter-templates (WordPress plugin) | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.Thi | high | 7.1 | 0% |
| CVE-2024-13450 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | low | 3.8 | 0% |
| CVE-2025-2109 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions | medium | 5.8 | 0% |
| CVE-2026-33486 | roadiz/documents | Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents | medium | 6.8 | 0% |
| CVE-2024-13923 | order-import-export-for-woocommerce (WordPress plugin) | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and | high | 7.6 | 0% |
| CVE-2026-35540 | roundcube/roundcubemail | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages | medium | 5.4 | 0% |
| CVE-2023-4893 | crayon-syntax-highlighter (WordPress plugin) | The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to | medium | 6.4 | 0% |
| CVE-2026-54491 | phanan/koel | Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths | high | 7.1 | 0% |
| CVE-2026-84189 | librenms/librenms | LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page | high | 8.1 | 0% |
| CVE-2025-1912 | product-import-export-for-woo (WordPress plugin) | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forger | high | 7.6 | 0% |
| CVE-2026-41055 | wwbn/avideo | WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF | medium | 5.3 | 0% |
| CVE-2024-13905 | onestore-sites (WordPress plugin) | The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the cla | medium | 5.3 | 0% |
| CVE-2026-69246 | guzzlehttp/guzzle | Guzzle: Noncanonical host can bypass host-based checks | high | 7.2 | 0% |
| CVE-2024-4354 | tablepress (WordPress plugin) | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-10903 | broken-link-checker (WordPress plugin) | The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow a | medium | 4.7 | 0% |
| CVE-2026-48013 | shopware/core, shopware/platform | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | medium | 4.1 | 0% |
| CVE-2023-6964 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all vers | high | 8.5 | 0% |
| CVE-2024-0628 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the | low | 3.8 | 0% |
| CVE-2025-8678 | johnbillion/wp-crontrol | WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery | medium | 0.0 | 0% |
| CVE-2024-13741 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all ver | medium | 5.4 | 0% |
| CVE-2026-32279 | opensource-workshop/connect-cms | Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin | medium | 6.8 | 0% |
| CVE-2026-55374 | jleehr/canto-saas-api | canto-saas-api: Authenticated API requests can be redirected via unencoded path variables | medium | 4.8 | 0% |
| CVE-2025-3192 | spatie/browsershot | Browsershot Server-Side Request Forgery (SSRF) via setURL() Function | high | 8.2 | 0% |
| CVE-2026-33237 | wwbn/avideo | AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation | medium | 5.5 | 0% |
| CVE-2026-49865 | kimai/kimai | Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs | medium | 0.0 | 0% |
| CVE-2026-43884 | wwbn/avideo | AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() | high | 7.7 | 0% |
| CVE-2023-6805 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind | medium | 6.4 | 0% |
| CVE-2024-10705 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includ | medium | 5.4 | 0% |
| CVE-2024-1568 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 | medium | 6.4 | 0% |
| CVE-2025-2940 | ninja-tables (WordPress plugin) | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and incl | high | 7.2 | 0% |
| CVE-2026-34740 | wwbn/avideo | AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation | medium | 6.5 | 0% |
| CVE-2026-41130 | craftcms/cms | Craft CMS has a host header injection leading to SSRF via resource-js endpoint | medium | 0.0 | 0% |
| CVE-2026-33480 | wwbn/avideo | AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy | high | 8.6 | 0% |
| CVE-2024-4404 | elementskit (WordPress plugin) | The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'rende | high | 8.5 | 0% |
| CVE-2025-9821 | mautic/core | Mautic vulnerable to SSRF via webhook function | low | 2.7 | 0% |
| CVE-2026-47260 | phanan/koel | Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs | high | 7.7 | 0% |
| CVE-2024-13838 | uncanny-automator (WordPress plugin) | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side R | medium | 5.5 | 0% |
| CVE-2026-41060 | wwbn/avideo | WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL | high | 7.7 | 0% |
| CVE-2024-5031 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via th | high | 8.5 | 0% |
| CVE-2024-6155 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request For | medium | 6.4 | 0% |
| CVE-2025-66844 | getgrav/grav | Grav may be vulnerable to SSRF attack via Twig Templates | critical | 9.1 | 0% |
| CVE-2026-57232 | contao/contao, contao/core-bundle | Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module | low | 3.1 | 0% |
| CVE-2026-50887 | shlinkio/shlink | shlink has a Server-Side Request Forgery issue | critical | 9.1 | 0% |
| CVE-2025-3775 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.5 | 0% |
| CVE-2025-28092 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload | medium | 6.3 | 0% |
| CVE-2025-28093 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings | medium | 6.3 | 0% |
| CVE-2025-1662 | url-media-uploader (WordPress plugin) | The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the | medium | 6.4 | 0% |
| CVE-2024-13697 | bp-better-messages (WordPress plugin) | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-S | medium | 4.8 | 0% |
| CVE-2026-33294 | wwbn/avideo | AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources | medium | 5.0 | 0% |