Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24220 | ignition (WordPress plugin), luxe (WordPress plugin), minus (WordPress plugin) +6 more | Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Them | critical | 9.1 | 4% |
| CVE-2020-6008 | lifterlms (WordPress plugin) | LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution | critical | 9.8 | 4% |
| CVE-2012-10019 | front-end-editor (WordPress plugin) | The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php fil | critical | 9.8 | 4% |
| CVE-2015-9228 | nextgen-gallery (WordPress plugin) | In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, | high | 8.8 | 4% |
| CVE-2021-24376 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Se | critical | 9.8 | 4% |
| CVE-2015-10144 | thumbnail-carousel-slider (WordPress plugin) | The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the vi | high | 8.8 | 4% |
| CVE-2018-16974 | elefant/cms | Elefant CMS Code Execution Vulnerability | critical | 9.8 | 4% |
| CVE-2018-19789 | symfony/form, symfony/symfony | Symfony Path Disclosure | medium | 5.3 | 4% |
| CVE-2017-15054 | nilsteampassnet/teampass | TeamPass arbitrary file upload vulnerability | high | 7.5 | 3% |
| CVE-2018-17573 | wp-insert (WordPress plugin) | The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor | critical | 9.8 | 3% |
| CVE-2021-27817 | shopxo/shopxo | ShopXO RCE Vulnerability | critical | 9.8 | 3% |
| CVE-2022-44289 | topthink/framework | Thinkphp has a code logic error | high | 8.8 | 3% |
| CVE-2021-24947 | responsive-vector-maps (WordPress plugin) | The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path par | medium | 6.5 | 3% |
| CVE-2021-24240 | business-hours-pro (WordPress plugin) | The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionali | critical | 9.8 | 3% |
| CVE-2008-2717 | typo3/cms-core | TYPO3 Unrestricted File Upload vulnerability | medium | 0.0 | 3% |
| CVE-2015-1000001 | fast-image-adder (WordPress plugin) | Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin | critical | 9.8 | 3% |
| CVE-2015-1000000 | mailcwp (WordPress plugin) | Remote file upload vulnerability in mailcwp v1.99 wordpress plugin | critical | 9.8 | 3% |
| CVE-2020-11476 | concrete5/concrete5 | Unrestricted Uploads in Concrete5 | high | 7.2 | 3% |
| CVE-2020-12675 | mappress-google-maps-for-wordpress (WordPress plugin) | The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions | high | 8.8 | 3% |
| CVE-2021-34551 | phpmailer/phpmailer | Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows | high | 8.1 | 3% |
| CVE-2015-9479 | acf-fronted-display (WordPress plugin) | The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery | critical | 9.8 | 3% |
| CVE-2019-9185 | bolt/bolt | Bolt Unrestricted Upload of File with Dangerous Type | high | 8.8 | 3% |
| CVE-2025-0520 | showdoc/showdoc | ShowDoc unrestricted file upload vulnerability | critical | 0.0 | 3% |
| CVE-2022-2180 | greyd.suite (WordPress plugin) | The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf che | critical | 9.8 | 3% |
| CVE-2025-3616 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val | high | 8.8 | 3% |
| CVE-2017-1002016 | flickr-picture-backup (WordPress plugin) | Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is au | critical | 9.8 | 3% |
| CVE-2019-16700 | slub/slub-events | slub_events for Typo3 Arbitrary File Upload | critical | 9.8 | 3% |
| CVE-2021-42171 | tribalsystems/zenario | Unrestricted Upload of File with Dangerous Type in Zenario CMS | critical | 9.8 | 3% |
| CVE-2023-49052 | microweber/microweber | Microweber file upload vulnerability | high | 8.8 | 2% |
| CVE-2020-35945 | divi (WordPress plugin), divi-builder (WordPress plugin), extra (WordPress plugin) | An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, wi | critical | 9.9 | 2% |
| CVE-2016-10955 | cysteme-finder (WordPress plugin) | The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking. | critical | 9.8 | 2% |
| CVE-2021-24222 | wp-curriculo-vitae-free (WordPress plugin) | The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is emb | critical | 9.8 | 2% |
| CVE-2019-7930 | magento/community-edition, magento/product-community-edition | Magento 2 Community Unrestricted File Upload | high | 7.2 | 2% |
| CVE-2018-18942 | baserproject/basercms | RCE in baserCMS before 4.1.4 | high | 7.2 | 2% |
| CVE-2023-24249 | encore/laravel-admin | laravel-admin has Arbitrary File Upload vulnerability | high | 7.2 | 2% |
| CVE-2010-3663 | typo3/cms-backend | TYPO3 Arbitrary Code Execution vulnerability on the backend | high | 8.8 | 2% |
| CVE-2024-7985 | fileorganizer (WordPress plugin) | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type | high | 7.5 | 2% |
| CVE-2016-15033 | delete-all-comments (WordPress plugin) | The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the dele | critical | 9.8 | 2% |
| CVE-2019-25138 | user-submitted-posts (WordPress plugin) | The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_i | critical | 9.8 | 2% |
| CVE-2017-14251 | typo3/cms | TYPO3 Arbitrary Code Execution | high | 8.8 | 2% |
| CVE-2020-15277 | baserproject/basercms | Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0 | high | 7.2 | 2% |
| CVE-2024-13869 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file | high | 7.2 | 2% |
| CVE-2016-10954 | neosense (WordPress theme) | The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload. | critical | 9.8 | 2% |
| CVE-2022-0921 | microweber/microweber | Unrestricted Upload of File with Dangerous Type in Microweber | medium | 6.7 | 2% |
| CVE-2021-24223 | n5-upload-form (WordPress plugin) | The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, a | critical | 9.8 | 2% |
| CVE-2022-4949 | adsanity (WordPress plugin) | The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function | high | 8.8 | 2% |
| CVE-2019-1010209 | gourl (WordPress plugin) | GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload | high | 7.5 | 2% |
| CVE-2021-34623 | profilepress (WordPress plugin) | A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made | critical | 9.8 | 2% |
| CVE-2022-28700 | give (WordPress plugin) | Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. | critical | 9.1 | 2% |
| CVE-2022-42092 | backdrop/backdrop | Backdrop CMS Unrestricted File Upload vulnerability | high | 7.2 | 2% |