Vulnerable PHP packages, WordPress plugins & themes

7,444 Composer packages, WordPress plugins/themes and PHP itself with at least one known advisory. Sorted by actively-exploited CVEs, then advisory count. See all advisories.

PackageEcosystemAdvisoriesCriticalKEV
drupal/coreComposer164185
craftcms/cmsComposer12794
drupal/drupalComposer96124
PHP enginePHP engine864
magento/community-editionComposer360523
WordPress coreWordPress345142
pear/archive_tarComposer612
magento/project-community-editionComposer161301
magento/product-community-editionComposer13301
laravel/frameworkComposer3831
october/systemComposer2511
phpmailer/phpmailerComposer1431
yiisoft/yii2Composer1321
roundcube/roundcubemailComposer1011
vrana/adminerComposer901
duplicator (WordPress plugin)WordPress811
wp-file-manager (WordPress plugin)WordPress831
litespeed-cache (WordPress plugin)WordPress711
livewire/livewireComposer711
contact-form-7 (WordPress plugin)WordPress621
phpunit/phpunitComposer511
social-warfare (WordPress plugin)WordPress511
facade/ignitionComposer331
components/jqueryComposer201
social-warfare-pro (WordPress plugin)WordPress101
moodle/moodleComposer43716–
typo3/cmsComposer2626–
wwbn/avideoComposer16016–
typo3/cms-coreComposer1581–
silverstripe/frameworkComposer1483–
pimcore/pimcoreComposer1355–
dolibarr/dolibarrComposer12727–
concrete5/concrete5Composer1212–
thorsten/phpmyfaqComposer1128–
symfony/symfonyComposer1118–
phpmyadmin/phpmyadminComposer10710–
librenms/librenmsComposer1066–
microweber/microweberComposer1060–
getgrav/gravComposer996–
snipe/snipe-itComposer811–
mantisbt/mantisbtComposer745–
shopware/platformComposer706–
shopware/coreComposer655–
froxlor/froxlorComposer6012–
mautic/coreComposer5710–
baserproject/basercmsComposer567–
zendframework/zendframework1Composer548–
getkirby/cmsComposer511–
admidio/admidioComposer503–
contao/core-bundleComposer504–
royal-elementor-addons (WordPress plugin)WordPress481–
easy-digital-downloads (WordPress plugin)WordPress473–
ninja-forms (WordPress plugin)WordPress474–
phpmyfaq/phpmyfaqComposer472–
download-manager (WordPress plugin)WordPress440–
statamic/cmsComposer441–
intelliants/subrionComposer422–
nilsteampassnet/teampassComposer425–
showdoc/showdocComposer424–
ultimate-member (WordPress plugin)WordPress425–
photo-gallery (WordPress plugin)WordPress406–
essential-addons-for-elementor-lite (WordPress plugin)WordPress380–
learnpress (WordPress plugin)WordPress388–
shopware/shopwareComposer384–
ci4-cms-erp/ci4msComposer3619–
contao/contaoComposer364–
phpoffice/phpspreadsheetComposer352–
sylius/syliusComposer350–
zendframework/zendframeworkComposer356–
kimai/kimaiComposer333–
drupal/webformComposer310–
prestashop/prestashopComposer316–
yeswiki/yeswikiComposer316–
give (WordPress plugin)WordPress306–
pocketmine/pocketmine-mpComposer300–
cakephp/cakephpComposer283–
mediawiki/coreComposer282–
premium-addons-for-elementor (WordPress plugin)WordPress280–
simplesamlphp/simplesamlphpComposer283–
wp-fastest-cache (WordPress plugin)WordPress282–
centreon/centreonComposer275–
contest-gallery (WordPress plugin)WordPress273–
twig/twigComposer271–
cockpit-hq/cockpitComposer263–
facturascripts/facturascriptsComposer265–
funadmin/funadminComposer2616–
grumpydictator/firefly-iiiComposer261–
openmage/magento-ltsComposer263–
typo3/cms-backendComposer260–
events-manager (WordPress plugin)WordPress251–
happy-elementor-addons (WordPress plugin)WordPress250–
magento/magento1ceComposer250–
mstore-api (WordPress plugin)WordPress2510–
nextgen-gallery (WordPress plugin)WordPress253–
magento/coreComposer2411–
magento/magento1eeComposer240–
shortcodes-ultimate (WordPress plugin)WordPress241–
bdthemes-element-pack-lite (WordPress plugin)WordPress230–
forminator (WordPress plugin)WordPress231–
phpoffice/phpexcelComposer230–
Page 1 of 75 · 7,444 packages