Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2012-6649 | wp-gpx-maps (WordPress plugin) | WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload. | critical | 9.8 | 16% |
| CVE-2015-9499 | showbiz-pro (WordPress plugin) | The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive. | critical | 9.8 | 16% |
| CVE-2023-6846 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_chec | high | 8.8 | 16% |
| CVE-2022-1103 | advanced-uploader (WordPress plugin) | The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, wh | high | 8.8 | 16% |
| CVE-2018-14028 | WordPress core | In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once | high | 7.2 | 15% |
| CVE-2020-10963 | frozennode/administrator | FrozenNode Laravel-Administrator unrestricted file upload | high | 7.2 | 15% |
| CVE-2023-4596 | forminator (WordPress plugin) | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uplo | critical | 9.8 | 14% |
| CVE-2024-55417 | tcg/voyager | DevDojo Voyager Arbitrary File Write | medium | 4.3 | 14% |
| CVE-2022-45359 | yith-woocommerce-gift-cards (WordPress plugin) | Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress. | critical | 9.8 | 14% |
| CVE-2020-24948 | autoptimize (WordPress plugin) | The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing | high | 7.2 | 13% |
| CVE-2013-1916 | user-photo (WordPress plugin) | In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on th | high | 8.8 | 13% |
| CVE-2017-1002002 | webapp-builder (WordPress plugin) | Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/ | critical | 9.8 | 13% |
| CVE-2017-1002003 | wp2android-turn-wp-site-into-android-app (WordPress plugin) | Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software fr | critical | 9.8 | 12% |
| CVE-2017-1002001 | mobile-app-builder-by-wappress (WordPress plugin) | Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://w | critical | 9.8 | 11% |
| CVE-2022-26149 | modx/revolution | Unrestricted Upload of File with Dangerous Type in MODX Revolution | high | 7.2 | 9% |
| CVE-2021-44673 | croogo/croogo | Unrestricted Upload of File with Dangerous Type in Croogo | high | 8.8 | 9% |
| CVE-2016-15043 | wp-mobile-detector (WordPress plugin) | The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file i | critical | 9.8 | 9% |
| CVE-2019-11223 | supportcandy (WordPress plugin) | An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrar | critical | 9.8 | 9% |
| CVE-2020-13126 | elementor-page-builder (WordPress plugin) | An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE | critical | 9.9 | 9% |
| CVE-2021-24160 | responsive-menu (WordPress plugin) | In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files th | high | 8.8 | 8% |
| CVE-2019-10869 | ninja-forms-file-uploads (WordPress plugin) | Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activat | high | 8.1 | 8% |
| CVE-2021-34624 | profilepress (WordPress plugin) | A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it | critical | 9.8 | 8% |
| CVE-2020-36849 | csv-import-\/-export (WordPress plugin) | The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-conten | critical | 9.8 | 8% |
| CVE-2021-24212 | help-scout (WordPress plugin) | The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated u | critical | 9.8 | 8% |
| CVE-2017-6104 | zen-mobile-app-native (WordPress plugin) | Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. | high | 7.5 | 7% |
| CVE-2021-24236 | imagements (WordPress plugin) | The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the requ | critical | 9.8 | 7% |
| CVE-2020-36705 | adning-advertising (WordPress plugin) | The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_ | critical | 9.8 | 7% |
| CVE-2016-15042 | frontend-file-manager (WordPress plugin), post-front-end-form (WordPress plugin) | The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary f | critical | 9.8 | 7% |
| CVE-2021-4436 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_ | critical | 9.8 | 7% |
| CVE-2025-6058 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() f | critical | 9.8 | 6% |
| CVE-2025-3515 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient f | high | 8.1 | 6% |
| CVE-2024-2667 | instawp-connect (WordPress plugin) | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file | critical | 9.8 | 6% |
| CVE-2020-12077 | mappress-google-maps-for-wordpress (WordPress plugin) | The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capabi | high | 8.8 | 6% |
| CVE-2015-10137 | website-contact-form-with-file-upload (WordPress plugin) | The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation i | critical | 9.8 | 5% |
| CVE-2021-4449 | zoomsounds (WordPress plugin) | The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in | critical | 9.8 | 5% |
| CVE-2020-24407 | magento/community-edition, magento/project-community-edition | Magento 2 Community Edition RCE via Unsafe File Upload | critical | 9.1 | 5% |
| CVE-2020-35949 | quiz-and-survey-master (WordPress plugin) | An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers t | critical | 10.0 | 5% |
| CVE-2022-47615 | learnpress (WordPress plugin) | Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. | critical | 9.3 | 5% |
| CVE-2018-12426 | live-chat (WordPress plugin) | The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side va | critical | 9.8 | 5% |
| CVE-2012-10020 | foxypress (WordPress plugin) | The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in | critical | 9.8 | 5% |
| CVE-2021-36440 | showdoc/showdoc | Unrestricted File Upload in ShowDoc v2.9.5 | critical | 9.8 | 5% |
| CVE-2014-4972 | ajax-upload-for-gravity-forms (WordPress plugin) | Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute ar | critical | 9.8 | 5% |
| CVE-2015-10135 | wpshop (WordPress plugin) | The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload | critical | 9.8 | 5% |
| CVE-2019-11185 | wp-live-chat-support (WordPress plugin) | The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incom | critical | 9.8 | 4% |
| CVE-2015-9271 | video-conference (WordPress plugin) | The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code bec | critical | 9.8 | 4% |
| CVE-2015-10138 | work-the-flow-file-upload (WordPress plugin) | The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery | critical | 9.8 | 4% |
| CVE-2021-21014 | magento/community-edition, magento/project-community-edition | Magento vulnerable to a file upload restriction bypass | critical | 9.1 | 4% |
| CVE-2019-19634 | verot/class.upload.php | class.upload.php in verot.net omits .pht from the set of dangerous file extensions | critical | 9.8 | 4% |
| CVE-2024-8425 | woocommerce-ultimate-gift-card (WordPress plugin) | The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in | critical | 9.8 | 4% |
| CVE-2016-9187 | moodle/moodle | Moodle Unrestricted file upload vulnerability | high | 8.8 | 4% |