Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-21311 KEV | vrana/adminer | SSRF in adminer | high | 7.2 | 98% |
| CVE-2022-1386 | avada (WordPress plugin), fusion-builder (WordPress plugin) | The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to | critical | 9.8 | 71% |
| CVE-2021-32682 | studio-42/elfinder | elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE | critical | 9.8 | 70% |
| CVE-2023-2249 | wpforo (WordPress plugin) | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions | high | 8.8 | 61% |
| CVE-2021-24472 | kentharadio (WordPress plugin), onair2 (WordPress plugin) | The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticat | critical | 9.8 | 57% |
| CVE-2019-16932 | visualizer (WordPress plugin) | A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data. | critical | 10.0 | 39% |
| CVE-2023-27159 | appwrite/server-ce | Appwrite Server-Side Request Forgery vulnerability | high | 7.5 | 36% |
| CVE-2020-28976 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any in | medium | 5.3 | 28% |
| CVE-2022-0591 | formcraft3 (WordPress plugin) | The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues e | critical | 9.1 | 20% |
| CVE-2025-8085 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthe | high | 8.6 | 20% |
| CVE-2018-1042 | moodle/moodle | Moodle SSRF Vulnerability | medium | 6.5 | 16% |
| CVE-2020-28977 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any inte | medium | 5.3 | 15% |
| CVE-2020-28978 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any inte | medium | 5.3 | 15% |
| CVE-2020-24148 | import-xml-feed (WordPress plugin) | Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a | critical | 9.1 | 14% |
| CVE-2019-17669 | WordPress core | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of | critical | 9.8 | 5% |
| CVE-2018-7667 | vrana/adminer | vrana/adminer vulnerable to SSRF by connecting to privileged ports | medium | 0.0 | 5% |
| CVE-2019-17670 | WordPress core | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation | critical | 9.8 | 5% |
| CVE-2021-24150 | likebtn-like-button (WordPress plugin) | The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Re | high | 7.5 | 4% |
| CVE-2016-4029 | WordPress core | WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote at | high | 8.6 | 4% |
| CVE-2017-9066 | WordPress core | In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. | high | 8.6 | 4% |
| CVE-2020-14044 | codiad/codiad | Codiad SSRF Vulnerability | high | 7.2 | 3% |
| CVE-2023-5974 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter. | critical | 9.8 | 3% |
| CVE-2022-1398 | external-media-without-import (WordPress plugin) | The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via UR | medium | 6.5 | 3% |
| CVE-2019-11565 | print-my-blog (WordPress plugin) | Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter. | critical | 9.8 | 3% |
| CVE-2021-36043 | magento/community-edition, magento/project-community-edition | Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension | high | 8.0 | 2% |
| CVE-2016-6621 | phpmyadmin/phpmyadmin | phpMyAdmin server-side request forgery (SSRF) | high | 8.6 | 2% |
| CVE-2019-7892 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability via SSRF | high | 7.2 | 2% |
| CVE-2019-8151 | magento/community-edition, magento/product-community-edition | Magento Server-Side Request Forgery (SSRF) | high | 7.2 | 2% |
| CVE-2019-8156 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SSRF vulnerability | high | 7.2 | 2% |
| CVE-2020-24149 | podcast-importer-secondline (WordPress plugin) | Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podca | high | 7.5 | 2% |
| CVE-2020-24142 | video-downloader-for-tiktok (WordPress plugin) | Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafte | critical | 9.8 | 2% |
| CVE-2016-10926 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php. | critical | 10.0 | 2% |
| CVE-2016-10927 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php. | critical | 10.0 | 2% |
| CVE-2022-0768 | rudloff/alltube | Server-Side Request Forgery (SSRF) in rudloff/alltube | critical | 9.1 | 2% |
| CVE-2020-24147 | wp-smart-import (WordPress plugin) | Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field. | critical | 9.1 | 2% |
| CVE-2021-45394 | spipu/html2pdf | Cross-site Scripting in HTML2PDF | high | 8.8 | 2% |
| CVE-2017-16790 | symfony/form, symfony/symfony | Symfony SSRF Vulnerability via Form Component | medium | 6.5 | 2% |
| CVE-2021-22970 | concrete5/core | Server-Side Request Forgery in Concrete CMS | medium | 0.0 | 1% |
| CVE-2020-24063 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF. | high | 7.2 | 1% |
| CVE-2022-45152 | moodle/moodle | Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library | critical | 9.1 | 1% |
| CVE-2019-7911 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Server-Side Request Forgery vulnerability | high | 7.2 | 1% |
| CVE-2019-7913 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SSRF vulnerability | high | 7.2 | 1% |
| CVE-2019-7923 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SSRF vulnerability | high | 7.2 | 1% |
| CVE-2021-36396 | moodle/moodle | Moodle vulnerable to Server-Side Request Forgery | high | 7.5 | 1% |
| CVE-2019-6970 | moodle/moodle | Moodle SSRF Vulnerability | high | 7.5 | 1% |
| CVE-2022-1239 | hubspot (WordPress plugin) | The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with th | high | 8.8 | 1% |
| CVE-2021-39339 | telefication (WordPress plugin) | The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-suppli | medium | 5.8 | 1% |
| CVE-2022-2352 | post-smtp (WordPress plugin) | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high | high | 7.2 | 1% |
| CVE-2017-1000017 | phpmyadmin/phpmyadmin | phpMyAdmin SSRF in replication | high | 8.8 | 1% |
| CVE-2022-1037 | exmage (WordPress plugin) | The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF iss | high | 7.2 | 1% |