phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.

19,303CVEs
8,638Composer advisories
12,328WordPress advisories
35Actively exploited (KEV) →
CVEPackageTitleSeverityCVSSEPSS
CVE-2022-1583external-links-in-new-window-\/-new-tab (WordPress plugin)The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to externamedium6.51%
CVE-2022-2600auto-hyperlink-urls (WordPress plugin)The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbimedium5.41%
Page 1 of 1 · 2 advisories
Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.