0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| wallabag project | wallabag | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown Official wallabag requirements state compatibility with PHP >=7.4 and require PHP-FPM plus extensions. |
source | |
| WampServer maintainers / Aviatechno | WampServer Windows development bundle | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The publisher distinguishes the full installer, manager updates and separately downloadable PHP add-ons; Apache/PHP and database administration tools are bundled. |
source | |
| webERP project | webERP | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official versioned manual requires PHP and separates feature-dependent FTP, translations and graphing extensions. |
source | |
| Webkul | Bagisto | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The guide separates manifest, web-installer and transitive extension requirements, and distinguishes Bagisto 2.4 from 2.5. |
source 1 source 2 |
|
| Webkul / UVdesk | UVdesk Community Helpdesk | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The Community repository documents a PHP/Symfony helpdesk, required mail extensions and console setup; its broad skeleton constraint differs from README guidance. |
source 1 source 2 |
|
| webonyx / GraphQL-PHP project | webonyx GraphQL-PHP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown This package implements GraphQL in PHP and declares optional AMPHP/ReactPHP integrations separately. |
source | |
| WebPros / cPanel | cPanel EasyApache 4 / MultiPHP | EA4 25.91: ea-php82 8.2.35; ea-php83 8.3.36; ea-php84 8.4.27; ea-php85 8.5.12; vendor-patched ea-php74/80/81 | Fix | Fix | CVE assessment: EA4 25.91 fixes both CVEs in ea-php82/83/84/85 and backports them to ea-php74/80/81. Older retained branches and third-party repositories are not covered by this confirmation. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| WebPros / cPanel | cPanel internal PHP for hooks and AppConfig applications | cPanel & WHM 136.0.50; bundled cpanel-php84 8.4.27 | Fix | Fix | CVE assessment: cPanel & WHM 136.0.50 updates its internal cpanel-php84 to 8.4.27 and explicitly fixes both CVEs. This is separate from hosted-site EA4 PHP. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 source 3 source 4 |
| Whirl-i-Gig / CollectiveAccess project | CollectiveAccess Providence | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor requires PHP and PHP CLI, lists required distro packages and distinguishes optional native image/cache adapters from external tools. |
source | |
| WHMCS Ltd. | WHMCS self-hosted application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade. The vendor's 9.0 and 8.13 matrices bind PHP and encoded-code loader versions to specific application branches. |
source 1 source 2 |
|
| Wikimedia / MediaWiki Platform maintainers | Excimer native PHP interrupting timer and sampling profiler | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Publisher PIE metadata identifies a C php-ext package; a fixed project-document revision explains the registry transition. |
source 1 source 2 source 3 |
|
| Wikimedia / MediaWiki project | Parsoid PHP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Parsoid is a PHP library converting wikitext and HTML; the older JavaScript implementation is explicitly historical. |
source | |
| Wikimedia Foundation | Wikimedia MediaWiki application-server PHP tier | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Wikimedia documents MediaWiki request execution through PHP-FPM. |
source 1 source 2 |
|
| Winter CMS project | Winter CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 1.2 installation guide requires PHP and named extensions. The project describes its Laravel foundation and historical October fork. |
source 1 source 2 source 3 |
|
| WoltLab GmbH | WoltLab Suite | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official requirements separate the PHP-capable server and extensions from ordinary browser clients; a companion matrix binds PHP ranges to Suite releases. |
source 1 source 2 |
|
| WooCommerce | WooCommerce | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The vendor distinguishes its recommended PHP stack from a still-compatible legacy floor and names optional integration requirements. |
source | |
| WooCommerce | WooCommerce PayPal Payments | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official plugin listing requires installed WooCommerce and PHP to connect a merchant store to PayPal. |
source | |
| WooCommerce | WooCommerce Stripe Payment Gateway | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The publisher-controlled plugin listing explicitly requires PHP for the WooCommerce Stripe integration. |
source | |
| WooCommerce | WooPayments merchant plugin | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official develop header labels version 11.2.0 and declares PHP 7.4, alongside separate WooCommerce and WordPress prerequisites. This corroborates registry metadata, not a verified release archive. |
source 1 source 2 source 3 |
|
| WordPress Playground contributors | PHP.wasm browser platform adapter | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The web adapter selects a browser-specific compiled PHP package. |
source | |
| WordPress Playground contributors | PHP.wasm Node.js platform adapter | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The Node adapter loads version-specific compiled PHP packages. |
source 1 source 2 |
|
| WordPress Playground contributors | PHP.wasm universal JavaScript API | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The universal package supplies the shared API without choosing a platform-specific PHP binary. |
source | |
| WordPress Playground contributors | WordPress Playground browser and local runtime | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown Playground uses a WebAssembly build of the PHP interpreter to run WordPress. |
source | |
| WordPress Playground contributors | WordPress Playground PHP.wasm binary family | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The architecture compiles the PHP interpreter to WebAssembly rather than reimplementing it in JavaScript. |
source 1 source 2 |
|
| WordPress project | WordPress | Installations served by unpatched PHP; application versions are not the patch boundary | Vulnerable | Vulnerable | CVE assessment: Automattic explains that these PHP CVEs affect self-hosted WordPress on an unpatched runtime and that updating WordPress, themes or plugins alone does not fix the runtime. This scope excludes its separately protected hosted platforms. Automattic explains that these PHP CVEs affect self-hosted WordPress on an unpatched runtime and that updating WordPress, themes or plugins alone does not fix the runtime. This scope excludes its separately protected hosted platforms. |
source 1 source 2 source 3 |
| WP Engine | WP Engine managed WordPress PHP hosting | Vendor-patched managed PHP infrastructure, confirmed 22 October 2026 | Fix | Fix | CVE assessment: WP Engine confirms all customer sites run fully patched PHP after deployment of official LTS-provider patches, separately from its earlier WAF and configuration mitigations. No customer action required for the managed hosting scope covered by WP Engine's confirmation. |
source 1 source 2 |
| WP-CLI / WordPress project | WP-CLI WordPress administration framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for wp-cli/wp-cli v2.12.0 declares PHP ^5.6 || ^7.0 || ^8.0 for this tool/library. |
source 1 source 2 |