Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-21311 KEV | vrana/adminer | SSRF in adminer | high | 7.2 | 98% |
| CVE-2022-1386 | avada (WordPress plugin), fusion-builder (WordPress plugin) | The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to | critical | 9.8 | 71% |
| CVE-2021-32682 | studio-42/elfinder | elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE | critical | 9.8 | 70% |
| CVE-2023-2249 | wpforo (WordPress plugin) | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions | high | 8.8 | 61% |
| CVE-2021-24472 | kentharadio (WordPress plugin), onair2 (WordPress plugin) | The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticat | critical | 9.8 | 57% |
| CVE-2019-16932 | visualizer (WordPress plugin) | A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data. | critical | 10.0 | 39% |
| CVE-2023-27159 | appwrite/server-ce | Appwrite Server-Side Request Forgery vulnerability | high | 7.5 | 36% |
| CVE-2021-38314 | gutenberg-template-library-\&-redux-framework (WordPress plugin) | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated | medium | 5.3 | 29% |
| CVE-2020-28976 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any in | medium | 5.3 | 28% |
| CVE-2022-0591 | formcraft3 (WordPress plugin) | The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues e | critical | 9.1 | 20% |
| CVE-2025-8085 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthe | high | 8.6 | 20% |
| CVE-2021-24867 | accessbuddy (WordPress plugin), accesspress-anonymous-post (WordPress plugin), accesspress-basic (WordPress plugin) +90 more | Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only | critical | 9.8 | 18% |
| CVE-2018-1042 | moodle/moodle | Moodle SSRF Vulnerability | medium | 6.5 | 16% |
| CVE-2020-28977 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any inte | medium | 5.3 | 15% |
| CVE-2020-28978 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any inte | medium | 5.3 | 15% |
| CVE-2020-24148 | import-xml-feed (WordPress plugin) | Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a | critical | 9.1 | 14% |
| CVE-2018-19277 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet due to encoding issue | high | 8.8 | 8% |
| CVE-2019-17669 | WordPress core | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of | critical | 9.8 | 5% |
| CVE-2022-34253 | magento/community-edition | Magento XML Injection vulnerability in the Widgets Module | critical | 9.1 | 5% |
| CVE-2020-24914 | qcubed/qcubed | qcubed PHP object injection | critical | 9.8 | 5% |
| CVE-2018-7667 | vrana/adminer | vrana/adminer vulnerable to SSRF by connecting to privileged ports | medium | 0.0 | 5% |
| CVE-2019-17670 | WordPress core | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation | critical | 9.8 | 5% |
| CVE-2021-24150 | likebtn-like-button (WordPress plugin) | The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Re | high | 7.5 | 4% |
| CVE-2016-4029 | WordPress core | WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote at | high | 8.6 | 4% |
| CVE-2017-9066 | WordPress core | In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. | high | 8.6 | 4% |
| CVE-2021-21019 | magento/community-edition | Magento XML injection in the Widgets module | critical | 9.1 | 4% |
| CVE-2021-36022 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the Widgets Update Layout | high | 7.2 | 3% |
| CVE-2021-21025 | magento/community-edition, magento/project-community-edition | Magento XPath Injection | critical | 9.1 | 3% |
| CVE-2020-14044 | codiad/codiad | Codiad SSRF Vulnerability | high | 7.2 | 3% |
| CVE-2023-5974 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter. | critical | 9.8 | 3% |
| CVE-2021-36033 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the Widgets Module | critical | 0.0 | 3% |
| CVE-2022-1398 | external-media-without-import (WordPress plugin) | The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via UR | medium | 6.5 | 3% |
| CVE-2021-36028 | magento/community-edition, magento/project-community-edition | Magento has an XML Injection vulnerability | critical | 0.0 | 3% |
| CVE-2019-11565 | print-my-blog (WordPress plugin) | Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter. | critical | 9.8 | 3% |
| CVE-2021-36020 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the 'City' field | high | 0.0 | 3% |
| CVE-2018-19296 | phpmailer/phpmailer | Phar object injection in PHPMailer | high | 8.8 | 2% |
| CVE-2020-15146 | sylius/resource-bundle | Remote Code Execution in SyliusResourceBundle | critical | 9.6 | 2% |
| CVE-2021-32758 | openmage/magento-lts | Layout XML Arbitrary Code Fix | high | 0.0 | 2% |
| CVE-2021-36043 | magento/community-edition, magento/project-community-edition | Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension | high | 8.0 | 2% |
| CVE-2016-6621 | phpmyadmin/phpmyadmin | phpMyAdmin server-side request forgery (SSRF) | high | 8.6 | 2% |
| CVE-2020-15143 | sylius/resource-bundle | Remote Code Execution in SyliusResourceBundle | high | 7.7 | 2% |
| CVE-2019-7892 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability via SSRF | high | 7.2 | 2% |
| CVE-2019-8151 | magento/community-edition, magento/product-community-edition | Magento Server-Side Request Forgery (SSRF) | high | 7.2 | 2% |
| CVE-2019-8156 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SSRF vulnerability | high | 7.2 | 2% |
| CVE-2020-24149 | podcast-importer-secondline (WordPress plugin) | Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podca | high | 7.5 | 2% |
| CVE-2020-24142 | video-downloader-for-tiktok (WordPress plugin) | Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafte | critical | 9.8 | 2% |
| CVE-2016-10926 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php. | critical | 10.0 | 2% |
| CVE-2016-10927 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php. | critical | 10.0 | 2% |
| CVE-2022-0768 | rudloff/alltube | Server-Side Request Forgery (SSRF) in rudloff/alltube | critical | 9.1 | 2% |
| CVE-2020-24147 | wp-smart-import (WordPress plugin) | Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field. | critical | 9.1 | 2% |