Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4539 | web-application-firewall (WordPress plugin) | The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due | medium | 5.3 | 1% |
| CVE-2022-4537 | hide-my-wp (WordPress plugin) | The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. T | medium | 6.5 | 0% |
| CVE-2023-2897 | brizy (WordPress plugin) | The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an | low | 3.7 | 0% |
| CVE-2024-6171 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all vers | medium | 5.3 | 0% |
| CVE-2022-4536 | ip-vault-wp-firewall (WordPress plugin) | The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to i | medium | 5.3 | 0% |
| CVE-2022-4529 | security-antivirus-firewall (WordPress plugin) | The Security, Antivirus, Firewall – S.A.F plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.3.5. | medium | 5.3 | 0% |
| CVE-2022-4533 | limit-login-attempts-plus (WordPress plugin) | The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due | medium | 5.3 | 0% |
| CVE-2025-24856 | causal/oidc | TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) | medium | 4.2 | 0% |
| CVE-2026-33690 | wwbn/avideo | AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() | medium | 5.3 | 0% |
| CVE-2026-63220 | codeigniter4/framework | CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() | medium | 4.8 | 0% |