Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-7725 | nukeviet/nukeviet | Deserialization of Untrusted Data in NukeViet | critical | 9.8 | 3% |
| CVE-2026-56700 | getgrav/grav | Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass | critical | 0.0 | 3% |
| CVE-2022-3357 | smart-slider-3 (WordPress plugin) | The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection i | high | 8.8 | 2% |
| CVE-2021-36567 | topthink/framework | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | 2% |
| CVE-2019-15521 | spoon/library | Spoon Library as used in Fork CMS allows PHP object injection | critical | 9.8 | 2% |
| CVE-2019-12240 | virim (WordPress plugin) | The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php. | critical | 9.8 | 2% |
| CVE-2019-15780 | formidable (WordPress plugin) | The formidable plugin before 4.02.01 for WordPress has unsafe deserialization. | critical | 9.8 | 2% |
| CVE-2019-8141 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2012-1605 | typo3/cms | Typo3 Extbase Framework Unsafe Deserialization | medium | 0.0 | 2% |
| CVE-2019-12241 | carts-guru (WordPress plugin) | The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handle | critical | 9.8 | 2% |
| CVE-2017-18605 | gravitate-qa-tracker (WordPress plugin) | The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection. | critical | 9.8 | 2% |
| CVE-2023-41330 | knplabs/knp-snappy | Snappy PHAR deserialization vulnerability | critical | 9.8 | 2% |
| CVE-2022-2444 | visualizer (WordPress plugin) | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 're | high | 8.8 | 2% |
| CVE-2019-10912 | symfony/cache, symfony/phpunit-bridge, symfony/symfony +2 more | Deserialization of untrusted data in Symfony | high | 7.1 | 2% |
| CVE-2018-19296 | phpmailer/phpmailer | Phar object injection in PHPMailer | high | 8.8 | 2% |
| CVE-2022-3861 | betheme (WordPress theme) | The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untr | high | 8.8 | 2% |
| CVE-2019-15319 | option-tree (WordPress plugin) | The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. | critical | 9.8 | 2% |
| CVE-2019-15320 | option-tree (WordPress plugin) | The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. | critical | 9.8 | 2% |
| CVE-2019-15321 | option-tree (WordPress plugin) | The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. | critical | 9.8 | 2% |
| CVE-2021-29476 | rmccue/requests | Insecure Deserialization of untrusted data in rmccue/requests | critical | 9.8 | 2% |
| CVE-2018-20987 | newsletters-lite (WordPress plugin) | The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection. | critical | 9.8 | 2% |
| CVE-2019-6338 | drupal/drupal, drupal/core | Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data | high | 8.0 | 2% |
| CVE-2012-3527 | typo3/cms | TYPO3 allows remote authenticated backend users to unserialize arbitrary objects | medium | 0.0 | 2% |
| CVE-2020-35932 | newsletter (WordPress plugin) | Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges ( | high | 7.5 | 2% |
| CVE-2020-35938 | post-grid (WordPress plugin), team-showcase (WordPress plugin) | PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbi | high | 7.5 | 2% |
| CVE-2020-35939 | post-grid (WordPress plugin), team-showcase (WordPress plugin) | PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject | high | 7.5 | 2% |
| CVE-2019-1000005 | mpdf/mpdf | mPDF Unsafe Deserialization | high | 8.8 | 2% |
| CVE-2021-24384 | joomsport (WordPress plugin) | The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated us | critical | 9.8 | 2% |
| CVE-2018-20984 | patreon-connect (WordPress plugin) | The patreon-connect plugin before 1.2.2 for WordPress has Object Injection. | critical | 9.8 | 2% |
| CVE-2021-39321 | sassy-social-share (WordPress plugin) | Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJ | high | 8.8 | 2% |
| CVE-2019-11458 | cakephp/cakephp | Unsafe deserialization in SmtpTransport in CakePHP | high | 7.5 | 2% |
| CVE-2020-11067 | typo3/cms, typo3/cms-core | Insecure Deserialization in Backend User Settings in TYPO3 CMS | high | 8.8 | 2% |
| CVE-2021-24280 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from | high | 8.8 | 2% |
| CVE-2021-36564 | topthink/framework | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | 2% |
| CVE-2021-24857 | totop-link (WordPress plugin) | The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Ob | critical | 9.8 | 2% |
| CVE-2020-28339 | usc-e-shop (WordPress plugin) | The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. Ther | high | 7.5 | 2% |
| CVE-2024-34515 | spatie/image-optimizer | image-optimizer allows PHAR deserialization | high | 8.8 | 2% |
| CVE-2022-2442 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter | high | 7.2 | 2% |
| CVE-2022-2436 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versi | high | 8.8 | 2% |
| CVE-2022-2438 | broken-link-checker (WordPress plugin) | The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to | high | 7.2 | 2% |
| CVE-2021-41129 | pterodactyl/panel | Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification | high | 8.1 | 2% |
| CVE-2021-23592 | topthink/framework | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | 2% |
| CVE-2022-2437 | feed-them-social (WordPress plugin) | The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the ' | critical | 9.8 | 2% |
| CVE-2020-36718 | ninja-gdpr-compliance (WordPress plugin) | The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deseri | critical | 9.8 | 2% |
| CVE-2022-1463 | booking-calendar (WordPress plugin) | The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, a | high | 8.8 | 2% |
| CVE-2019-16317 | pimcore/pimcore | Pimcore RCE via PHAR upload | high | 8.8 | 2% |
| CVE-2023-1381 | wp-meta-seo (WordPress plugin) | The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to | high | 8.8 | 2% |
| CVE-2023-6654 | phpems/phpems | PHPEMS Deserialization of Untrusted Data vulnerability | medium | 6.3 | 2% |
| CVE-2017-18604 | sitebuilder-dynamic-components (WordPress plugin) | The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request. | high | 7.5 | 2% |
| CVE-2022-3380 | customizer-export\/import (WordPress plugin) | The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object inje | high | 7.2 | 2% |