0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| wallabag project | wallabag | Official wallabag/wallabag Docker image 2.6.14.1; PHP 8.2.35 | Fix | Fix | CVE assessment: The published official wallabag Docker image 2.6.14.1 includes fixes for both CVEs, with PHP 8.2.35 on Alpine 3.22. This is an image rebuild; arbitrary source installations and older Docker images are outside the fixed scope. Pull the official wallabag/wallabag:2.6.14.1 image and recreate the container. Patch PHP independently for source deployments. |
source 1 source 2 source 3 source 4 |
| WampServer maintainers / Aviatechno | WampServer Windows development bundle | Windows x64 PHP add-ons 8.2.35.1, 8.3.36.1, 8.4.27.1 or 8.5.12.1 | Fix | Fix | CVE assessment: The publisher's 2026-10-28 warning supplies these PHP security add-ons. Their PHP source versions match the upstream fixes for both CVEs. The older full installer and a Wampmanager-only update do not establish a fixed runtime. Install and select a fixed PHP add-on for Apache and every FCGI VirtualHost; follow the publisher's manager-runtime and restart instructions. |
source 1 source 2 source 3 |
| webERP project | webERP | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official versioned manual requires PHP and separates feature-dependent FTP, translations and graphing extensions. |
source | |
| Webkul | Bagisto | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The guide separates manifest, web-installer and transitive extension requirements, and distinguishes Bagisto 2.4 from 2.5. |
source 1 source 2 |
|
| Webkul / UVdesk | UVdesk Community Helpdesk | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The Community repository documents a PHP/Symfony helpdesk, required mail extensions and console setup; its broad skeleton constraint differs from README guidance. |
source 1 source 2 |
|
| webonyx / GraphQL-PHP project | webonyx GraphQL-PHP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown This package implements GraphQL in PHP and declares optional AMPHP/ReactPHP integrations separately. |
source | |
| WebPros / cPanel | cPanel EasyApache 4 / MultiPHP | EA4 25.91: ea-php82 8.2.35; ea-php83 8.3.36; ea-php84 8.4.27; ea-php85 8.5.12; vendor-patched ea-php74/80/81 | Fix | Fix | CVE assessment: EA4 25.91 fixes both CVEs in ea-php82/83/84/85 and backports them to ea-php74/80/81. Older retained branches and third-party repositories are not covered by this confirmation. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| WebPros / cPanel | cPanel internal PHP for hooks and AppConfig applications | cPanel & WHM 136.0.50; bundled cpanel-php84 8.4.27 | Fix | Fix | CVE assessment: cPanel & WHM 136.0.50 updates its internal cpanel-php84 to 8.4.27 and explicitly fixes both CVEs. This is separate from hosted-site EA4 PHP. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 source 3 source 4 |
| Whirl-i-Gig / CollectiveAccess project | CollectiveAccess Providence | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor requires PHP and PHP CLI, lists required distro packages and distinguishes optional native image/cache adapters from external tools. |
source | |
| WHMCS Ltd. | WHMCS self-hosted application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade. The vendor's 9.0 and 8.13 matrices bind PHP and encoded-code loader versions to specific application branches. |
source 1 source 2 |
|
| Wikimedia / MediaWiki Platform maintainers | Excimer native PHP interrupting timer and sampling profiler | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Publisher PIE metadata identifies a C php-ext package; a fixed project-document revision explains the registry transition. |
source 1 source 2 source 3 |
|
| Wikimedia / MediaWiki project | Parsoid PHP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Parsoid is a PHP library converting wikitext and HTML; the older JavaScript implementation is explicitly historical. |
source | |
| Wikimedia Foundation | Wikimedia MediaWiki application-server PHP tier | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Wikimedia documents MediaWiki request execution through PHP-FPM. |
source 1 source 2 |
|
| Winter CMS project | Winter CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 1.2 installation guide requires PHP and named extensions. The project describes its Laravel foundation and historical October fork. |
source 1 source 2 source 3 |
|
| WoltLab GmbH | WoltLab Suite | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official requirements separate the PHP-capable server and extensions from ordinary browser clients; a companion matrix binds PHP ranges to Suite releases. |
source 1 source 2 |
|
| WooCommerce | WooCommerce | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The vendor distinguishes its recommended PHP stack from a still-compatible legacy floor and names optional integration requirements. |
source | |
| WooCommerce | WooCommerce PayPal Payments | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official plugin listing requires installed WooCommerce and PHP to connect a merchant store to PayPal. |
source | |
| WooCommerce | WooCommerce Stripe Payment Gateway | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The publisher-controlled plugin listing explicitly requires PHP for the WooCommerce Stripe integration. |
source | |
| WooCommerce | WooPayments merchant plugin | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official develop header labels version 11.2.0 and declares PHP 7.4, alongside separate WooCommerce and WordPress prerequisites. This corroborates registry metadata, not a verified release archive. |
source 1 source 2 source 3 |
|
| WordPress Playground contributors | PHP.wasm browser platform adapter | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The web adapter selects a browser-specific compiled PHP package. |
source | |
| WordPress Playground contributors | PHP.wasm Node.js platform adapter | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The Node adapter loads version-specific compiled PHP packages. |
source 1 source 2 |
|
| WordPress Playground contributors | PHP.wasm universal JavaScript API | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The universal package supplies the shared API without choosing a platform-specific PHP binary. |
source | |
| WordPress Playground contributors | WordPress Playground browser and local runtime | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown Playground uses a WebAssembly build of the PHP interpreter to run WordPress. |
source | |
| WordPress Playground contributors | WordPress Playground PHP.wasm binary family | PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; Git dcd8e50fb651 (web/Node, JSPI/Asyncify) | Fix | Fix | CVE assessment: Fixed in the public Git binaries at dcd8e50fb65121726bb23a686746f68032ff1cb1 (rebuild 11ddfdc9858269b131536f3052648f0a74d95387): PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, web and Node, JSPI and Asyncify. No npm release, legacy build or deployed Playground instance is confirmed by this assessment. Fix for the rebuilt PHP 8.2-8.5 Wasm binaries available at pinned Git commit dcd8e50fb651. A maintainer confirmed the rebuild for both CVEs. This assessment does not confirm an npm release, legacy PHP builds or a deployed Playground instance. |
source 1 source 2 source 3 source 4 source 5 source 6 source 7 source 8 |
| WordPress project | WordPress | Installations served by unpatched PHP; application versions are not the patch boundary | Vulnerable | Vulnerable | CVE assessment: Automattic explains that these PHP CVEs affect self-hosted WordPress on an unpatched runtime and that updating WordPress, themes or plugins alone does not fix the runtime. This scope excludes its separately protected hosted platforms. Automattic explains that these PHP CVEs affect self-hosted WordPress on an unpatched runtime and that updating WordPress, themes or plugins alone does not fix the runtime. This scope excludes its separately protected hosted platforms. |
source 1 source 2 source 3 |
| WP Engine | WP Engine managed WordPress PHP hosting | Vendor-patched managed PHP infrastructure, confirmed 22 October 2026 | Fix | Fix | CVE assessment: WP Engine confirms all customer sites run fully patched PHP after deployment of official LTS-provider patches, separately from its earlier WAF and configuration mitigations. No customer action required for the managed hosting scope covered by WP Engine's confirmation. |
source 1 source 2 |
| WP-CLI / WordPress project | WP-CLI WordPress administration framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for wp-cli/wp-cli v2.12.0 declares PHP ^5.6 || ^7.0 || ^8.0 for this tool/library. |
source 1 source 2 |