Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-48013 | shopware/core, shopware/platform | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | medium | 4.1 | 0% |
| CVE-2023-6964 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all vers | high | 8.5 | 0% |
| CVE-2024-0628 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the | low | 3.8 | 0% |
| CVE-2025-8678 | johnbillion/wp-crontrol | WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery | medium | 0.0 | 0% |
| CVE-2024-13741 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all ver | medium | 5.4 | 0% |
| CVE-2026-32279 | opensource-workshop/connect-cms | Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin | medium | 6.8 | 0% |
| CVE-2026-55374 | jleehr/canto-saas-api | canto-saas-api: Authenticated API requests can be redirected via unencoded path variables | medium | 4.8 | 0% |
| CVE-2025-3192 | spatie/browsershot | Browsershot Server-Side Request Forgery (SSRF) via setURL() Function | high | 8.2 | 0% |
| CVE-2026-33237 | wwbn/avideo | AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation | medium | 5.5 | 0% |
| CVE-2026-49865 | kimai/kimai | Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs | medium | 0.0 | 0% |
| CVE-2026-43884 | wwbn/avideo | AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() | high | 7.7 | 0% |
| CVE-2026-28781 | craftcms/cms | Craft CMS: Entries Authorship Spoofing via Mass Assignment | medium | 0.0 | 0% |
| CVE-2026-32870 | getkirby/cms | Kirby has XML injection in its XML creator toolkit | medium | 0.0 | 0% |
| CVE-2023-6805 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind | medium | 6.4 | 0% |
| CVE-2024-10705 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includ | medium | 5.4 | 0% |
| CVE-2024-1568 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 | medium | 6.4 | 0% |
| CVE-2025-2940 | ninja-tables (WordPress plugin) | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and incl | high | 7.2 | 0% |
| CVE-2026-34740 | wwbn/avideo | AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation | medium | 6.5 | 0% |
| CVE-2026-41130 | craftcms/cms | Craft CMS has a host header injection leading to SSRF via resource-js endpoint | medium | 0.0 | 0% |
| CVE-2026-33480 | wwbn/avideo | AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy | high | 8.6 | 0% |
| CVE-2024-4404 | elementskit (WordPress plugin) | The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'rende | high | 8.5 | 0% |
| CVE-2025-9821 | mautic/core | Mautic vulnerable to SSRF via webhook function | low | 2.7 | 0% |
| CVE-2026-47260 | phanan/koel | Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs | high | 7.7 | 0% |
| CVE-2024-13838 | uncanny-automator (WordPress plugin) | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side R | medium | 5.5 | 0% |
| CVE-2026-41060 | wwbn/avideo | WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL | high | 7.7 | 0% |
| CVE-2024-5031 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via th | high | 8.5 | 0% |
| CVE-2024-6155 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request For | medium | 6.4 | 0% |
| CVE-2025-66844 | getgrav/grav | Grav may be vulnerable to SSRF attack via Twig Templates | critical | 9.1 | 0% |
| CVE-2026-57232 | contao/contao, contao/core-bundle | Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module | low | 3.1 | 0% |
| CVE-2026-50887 | shlinkio/shlink | shlink has a Server-Side Request Forgery issue | critical | 9.1 | 0% |
| CVE-2025-3775 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.5 | 0% |
| CVE-2025-28092 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload | medium | 6.3 | 0% |
| CVE-2025-28093 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings | medium | 6.3 | 0% |
| CVE-2025-1662 | url-media-uploader (WordPress plugin) | The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the | medium | 6.4 | 0% |
| CVE-2024-13697 | bp-better-messages (WordPress plugin) | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-S | medium | 4.8 | 0% |
| CVE-2025-13081 | drupal/core | Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the | medium | 5.9 | 0% |
| CVE-2026-33294 | wwbn/avideo | AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources | medium | 5.0 | 0% |
| CVE-2026-41129 | craftcms/cms | Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations | medium | 0.0 | 0% |
| CVE-2025-47936 | typo3/cms-webhooks | TYPO3 CMS Webhooks Server Side Request Forgery | low | 3.3 | 0% |
| CVE-2026-27732 | wwbn/avideo | AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php | high | 8.1 | 0% |
| CVE-2026-40486 | kimai/kimai | Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate | medium | 4.3 | 0% |
| CVE-2024-13834 | responsive-add-ons (WordPress plugin) | The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable t | medium | 5.4 | 0% |
| CVE-2024-0677 | pz-linkcard (WordPress plugin) | The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could a | medium | 5.1 | 0% |
| CVE-2024-2090 | remote-content-shortcode (WordPress plugin) | The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via | medium | 6.4 | 0% |
| CVE-2024-13695 | enfold (WordPress theme) | The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_ | medium | 6.4 | 0% |
| CVE-2025-5817 | import-products-to-wc (WordPress plugin) | The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1 | high | 7.2 | 0% |
| CVE-2024-13845 | gravity-forms-webhooks (WordPress plugin) | The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via | medium | 5.5 | 0% |
| CVE-2026-33347 | league/commonmark | league/commonmark has an embed extension allowed_domains bypass | medium | 0.0 | 0% |
| CVE-2026-38527 | krayin/laravel-crm | Webkul Krayin CRM has Server-Side Request Forgery (SSRF) | high | 8.5 | 0% |
| CVE-2026-46683 | knplabs/knp-snappy | Snappy : SSRF and local file read via the xsl-style-sheet option | medium | 0.0 | 0% |