Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-36727 | newsletter-manager (WordPress plugin) | The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due t | critical | 9.8 | 2% |
| CVE-2022-2434 | string-locator (WordPress plugin) | The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versi | high | 8.8 | 2% |
| CVE-2022-2433 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeate | high | 7.5 | 2% |
| CVE-2019-12747 | typo3/cms, typo3/cms-core | TYPO3 Vulnerable to Insecure Deserialization | high | 8.8 | 2% |
| CVE-2020-36726 | ultimate-reviews (WordPress plugin) | The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization | critical | 9.8 | 2% |
| CVE-2024-28861 | friendsofsymfony1/symfony1 | Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder | medium | 0.0 | 2% |
| CVE-2022-3374 | ocean-extra (WordPress plugin) | The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues | high | 7.2 | 2% |
| CVE-2022-3335 | kadence-woocommerce-email-designer (WordPress plugin) | The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP o | high | 7.2 | 2% |
| CVE-2022-3334 | easy-wp-smtp (WordPress plugin) | The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue | high | 7.2 | 1% |
| CVE-2022-3366 | capabilities (WordPress plugin) | The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the co | high | 7.2 | 1% |
| CVE-2024-28859 | friendsofsymfony1/swiftmailer, friendsofsymfony1/symfony1, swiftmailer/swiftmailer | Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency | medium | 5.0 | 1% |
| CVE-2023-4402 | essential-blocks (WordPress plugin), essential-blocks-pro (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization | high | 8.1 | 1% |
| CVE-2024-10828 | woo-order-export-lite (WordPress plugin) | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3 | high | 8.1 | 1% |
| CVE-2022-2903 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object inj | high | 7.2 | 1% |
| CVE-2021-3838 | dompdf/dompdf | Deserialization of Untrusted Data in dompdf/dompdf | critical | 9.8 | 1% |
| CVE-2025-0912 | give (WordPress plugin) | The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserializa | critical | 9.8 | 1% |
| CVE-2024-9634 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | critical | 9.8 | 1% |
| CVE-2023-6528 | slider-revolution (WordPress plugin) | The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary conte | high | 8.8 | 1% |
| CVE-2013-7075 | typo3/cms | TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component | medium | 6.3 | 1% |
| CVE-2019-19849 | typo3/cms, typo3/cms-core | TYPO3 Insecure Deserialization in Query Generator & Query View | high | 8.8 | 1% |
| CVE-2022-39297 | melisplatform/melis-cms | melisplatform/melis-cms vulnerable to deserialization of untrusted data | high | 7.7 | 1% |
| CVE-2022-39298 | melisplatform/melis-front | melisplatform/melis-front vulnerable to deserialization of untrusted data | high | 7.7 | 1% |
| CVE-2020-15244 | openmage/magento-lts | RCE via PHP Object injection via SOAP Requests | high | 8.0 | 1% |
| CVE-2024-12877 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | critical | 9.8 | 1% |
| CVE-2022-41922 | yiisoft/yii | Prevent RCE when deserializing untrusted user input | high | 8.1 | 1% |
| CVE-2022-45982 | topthink/think | Deserialization of Untrusted Data in thinkphp | critical | 9.8 | 1% |
| CVE-2024-1813 | simple-job-board (WordPress plugin) | The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserializa | critical | 9.8 | 1% |
| CVE-2024-2006 | post-grid-carousel-ultimate (WordPress plugin) | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Obj | high | 8.8 | 1% |
| CVE-2021-21426 | openmage/magento-lts | Fixes a bug in Zend Framework's Stream HTTP Wrapper | critical | 9.8 | 1% |
| CVE-2025-3439 | everest-forms (WordPress plugin) | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Ob | critical | 9.8 | 1% |
| CVE-2023-4971 | weaver-xtreme-theme-support (WordPress plugin) | The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object i | high | 7.2 | 1% |
| CVE-2024-1950 | woo-product-carousel-slider-and-grid-ultimate (WordPress plugin) | The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to | high | 7.5 | 1% |
| CVE-2024-10936 | string-locator (WordPress plugin) | The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserializatio | high | 8.8 | 1% |
| CVE-2024-0668 | advanced-database-cleaner (WordPress plugin) | The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via des | medium | 6.6 | 1% |
| CVE-2023-3343 | user-registration (WordPress plugin) | The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization | high | 8.8 | 1% |
| CVE-2023-36825 | orchid/platform | Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution | critical | 9.8 | 1% |
| CVE-2023-28667 | lead-generated (WordPress plugin) | The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels para | critical | 9.8 | 1% |
| CVE-2023-1196 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, w | high | 8.8 | 1% |
| CVE-2024-24926 | brooklyn (WordPress plugin) | Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affe | high | 7.5 | 1% |
| CVE-2023-5583 | wp-simple-galleries (WordPress plugin) | The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserializatio | high | 8.8 | 1% |
| CVE-2024-11465 | yikes-inc-easy-custom-woocommerce-product-tabs (WordPress plugin) | The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 | high | 7.2 | 1% |
| CVE-2024-8514 | google-website-translator (WordPress plugin) | The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, | critical | 9.1 | 1% |
| CVE-2024-40624 | torrentpier/torrentpier | TorrentPier Deserialization of Untrusted Data vulnerability | critical | 9.8 | 1% |
| CVE-2024-1772 | play-ht (WordPress plugin) | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to PHP Object Injection in all ve | high | 8.8 | 1% |
| CVE-2026-45162 | pimcore/pimcore | Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction | high | 8.0 | 1% |
| CVE-2024-55638 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2022-3342 | zero-bs-crm (WordPress plugin) | The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLi | high | 7.5 | 1% |
| CVE-2026-23524 | laravel/reverb | Laravel Redis Horizontal Scaling Insecure Deserialization | critical | 9.8 | 1% |
| CVE-2024-1773 | pdf-invoices-and-packing-slips-for-woocommerce (WordPress plugin) | The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc | high | 8.8 | 1% |
| CVE-2022-3525 | librenms/librenms | Deserialization of Untrusted Data in librenms/librenms | high | 8.8 | 1% |