Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-34646 | woocommerce-jetpack (WordPress plugin) | Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the proces | critical | 9.8 | 51% |
| CVE-2022-3180 | wpgateway (WordPress plugin) | The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated | critical | 9.8 | 9% |
| CVE-2019-20203 | postie (WordPress plugin) | The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From inf | medium | 5.3 | 2% |
| CVE-2026-55584 | phpsysinfo/phpsysinfo | phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers | high | 7.5 | 2% |
| CVE-2022-2368 | microweber/microweber | Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password | medium | 6.5 | 1% |
| CVE-2022-4746 | fluentauth (WordPress plugin) | The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, wh | high | 7.5 | 1% |
| CVE-2022-4303 | wp-limit-login-attempts (WordPress plugin) | The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_AD | high | 7.5 | 1% |
| CVE-2022-4550 | user-activity (WordPress plugin) | The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which | high | 7.5 | 1% |
| CVE-2026-64665 | statamic/cms | Statamic: Account takeover via OAuth email matching without email-verification check | high | 8.1 | 1% |
| CVE-2026-33661 | yansongda/pay | WeChat Pay callback signature verification bypassed when Host header is localhost | high | 8.6 | 1% |
| CVE-2023-0816 | formidable-form-builder (WordPress plugin) | The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leadi | medium | 6.5 | 0% |
| CVE-2026-45074 | symfony/security-http, symfony/symfony | Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay | medium | 0.0 | 0% |
| CVE-2026-48016 | shopware/core, shopware/platform | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment | medium | 4.3 | 0% |
| CVE-2026-45063 | symfony/security-http, symfony/symfony | Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator | high | 0.0 | 0% |
| CVE-2024-13685 | admin-and-site-enhancements (WordPress plugin) | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allow | medium | 5.3 | 0% |
| CVE-2026-31889 | shopware/core, shopware/platform | Shopware vulnerable to a potential take over of app credentials | high | 8.9 | 0% |
| CVE-2025-60868 | alt-design/alt-redirect | Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw | medium | 6.5 | 0% |