PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.

19,303CVEs

8,638Composer advisories

12,328WordPress advisories

35Actively exploited (KEV) →

CVE	Package	Title	Severity	CVSS	EPSS
CVE-2024-10781	cleantalk-spam-protect (WordPress plugin)	The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due t	high	8.1	4%
CVE-2024-4611	apppresser (WordPress plugin)	The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCoo	high	8.1	1%
CVE-2025-58758	datahihi1/tiny-env	TinyEnv: Missing .env file not required — may cause unexpected behavior	medium	5.1	0%

Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.