Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-104890 | kunstmaan/bundles-cms, kunstmaan/media-bundle | Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote c | high | 7.2 | 0% |
| CVE-2024-2125 | envialosimple-email-marketing-y-newsletters-gratis (WordPress plugin) | The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | high | 8.8 | 0% |
| CVE-2024-3112 | quotes-and-tips (WordPress plugin) | The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege use | medium | 4.8 | 0% |
| CVE-2026-71434 | statamic/cms | Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types | medium | 5.3 | 0% |
| CVE-2024-47528 | librenms/librenms | LibreNMS vulnerable to Stored Cross-site Scripting via File Upload | medium | 4.8 | 0% |
| CVE-2026-54087 | easycorp/easyadmin-bundle | EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField | high | 7.6 | 0% |
| CVE-2026-33717 | wwbn/avideo | AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL | high | 8.8 | 0% |
| CVE-2024-51991 | october/october, october/system | October CMS Allows Unprotected SVG Rename in Media Manager | low | 0.0 | 0% |
| CVE-2025-51511 | cadmium-org/cadmium-cms | Cadmium CMS has a background arbitrary file upload vulnerability | high | 0.0 | 0% |
| CVE-2024-8725 | file-manager-advanced (WordPress plugin) | Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper chec | medium | 6.8 | 0% |
| CVE-2026-38991 | cockpit-hq/cockpit | Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type | high | 8.8 | 0% |
| CVE-2024-9417 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validat | medium | 6.1 | 0% |
| CVE-2024-45960 | tribalsystems/zenario | Zenario allows authenticated admin users to upload PDF files containing malicious code | medium | 4.8 | 0% |
| CVE-2023-25365 | october/october | October CMS Cross-site Scripting vulnerability | high | 7.8 | 0% |
| CVE-2025-58769 | auth0/auth0-php | auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | 0% |
| CVE-2025-51489 | moonshine/moonshine | MoonShine Arbitrary File Upload Vulnerability | medium | 4.5 | 0% |
| CVE-2024-8918 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This | high | 7.4 | 0% |
| CVE-2026-42844 | getgrav/grav | Low-privileged Grav API users can create super-admin accounts via blueprint-upload | high | 0.0 | 0% |
| CVE-2024-13544 | zarinpal-paid-download (WordPress plugin) | The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as adm | medium | 4.8 | 0% |
| CVE-2024-12042 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pro | medium | 5.4 | 0% |
| CVE-2024-5226 | fuse-social-floating-sidebar (WordPress plugin) | The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all | medium | 6.4 | 0% |
| CVE-2024-3344 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-10584 | directorypress (WordPress plugin) | The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG | medium | 5.4 | 0% |
| CVE-2024-13708 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2. | high | 7.2 | 0% |
| CVE-2025-8889 | compress-\&-upload (WordPress plugin) | The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin t | low | 3.8 | 0% |
| CVE-2025-27411 | redaxo/source | REDAXO allows Arbitrary File Upload in the mediapool page | medium | 5.4 | 0% |
| CVE-2026-54179 | backpack/crud | Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk | medium | 4.4 | 0% |
| CVE-2024-1332 | custom-fonts (WordPress plugin) | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all vers | medium | 6.4 | 0% |
| CVE-2026-42879 | facturascripts/facturascripts | FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images | medium | 6.3 | 0% |
| CVE-2026-32278 | opensource-workshop/connect-cms | Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin | high | 8.2 | 0% |
| CVE-2025-47939 | typo3/cms-core | TYPO3 Allows Unrestricted File Upload in File Abstraction Layer | medium | 5.4 | 0% |
| GHSA-hgjx-r89m-m7v4 | facturascripts/facturascripts | FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE | critical | 9.9 | – |
| CVE-2026-76913 | notrinos/notrinos-erp | NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file) | high | 8.8 | – |
| GHSA-8h4m-r4wm-xj7r | typo3/cms | TYPO3 Arbitrary Code Execution via File List Module | high | 8.8 | – |
| GHSA-f9hr-7cfq-mjg2 | typo3/cms-core | TYPO3 Arbitrary Code Execution via File List Module | high | 8.8 | – |
| GHSA-vcg6-8fxc-x5cq | silverstripe/framework | silverstripe/framework allows upload of dangerous file types | high | 8.8 | – |
| GHSA-gxxh-8vcj-w2mh | mckenziearts/livewire-markdown-editor | livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler | high | 7.1 | – |
| GHSA-7gwj-7fhm-vw4w | drupal/core | Drupal core unrestricted file upload | medium | 6.6 | – |
| GHSA-7jp2-5h22-m432 | auth0/symfony | Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | – |
| GHSA-hjfh-5jmm-xr24 | auth0/login | laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | – |
| GHSA-58xv-7h9r-mx3c | drupal/drupal | Drupal Malicious file upload with filenames stating with dot | medium | 0.0 | – |
| GHSA-9j39-4686-m3c4 | ibexa/core | Ibexa Kernel's files with blacklisted extensions can be still saved to drafts | medium | 0.0 | – |
| GHSA-mwvh-p3hx-x4gg | ezsystems/ezplatform-kernel | Ibexa Kernel's files with blacklisted extensions can be still saved to drafts | medium | 0.0 | – |