PHP Everywhere

PHP Everywhere has 4 disclosed vulnerabilities in the WordSec catalog, all reported in 2022; all 4 are fixed as of September 2026. Their average CVSS score is 9.6, and the most serious one scores 9.9 out of 10. Severity breakdown: 3 critical and 1 high. 2022 was the busiest year with 4 disclosures.

The most common weakness is Code Injection, behind 3 of the records (75%). Other recurring categories include Cross-Site Request Forgery (CSRF).

Every one of the 4 issues recorded for PHP Everywhere has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (3) reported by Ram.

Strategic Overview

Avg CVSSCritical

9.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all PHP Everywhere vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.9CVE-2022-24665

PHP Everywhere <= 2.0.3 - Remote Code Execution by Contributor+ users via gutenberg block

Read the full analysis

Vulnerability Records

4 records


2022-01-13 10:26	PHP Everywhere <= 2.0.2 - Cross-Site Request Forgery PHP Everywhere <= 2.0.2	`CVE-2021-23227`	8.8 High	Rasi Afeef	Yes
2022-01-04 00:00	PHP Everywhere <= 2.0.3 - Remote Code Execution by Contributor+ users via gutenberg block PHP Everywhere <= 2.0.3	`CVE-2022-24665`	9.9 Critical	Ram	Yes
2022-01-04 00:00	PHP Everywhere <= 2.0.3 - Authenticated (Contributor+) Remote Code Execution via Metabox PHP Everywhere <= 2.0.3	`CVE-2022-24664`	9.9 Critical	Ram	Yes
2022-01-04 00:00	PHP Everywhere <= 2.0.3 - Remote Code Execution by Subscriber+ users via shortcode PHP Everywhere <= 2.0.3	`CVE-2022-24663`	9.9 Critical	Ram	Yes

Showing 1–4 of 4 reports