Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-41711 | badaso/core | Badaso vulnerable to Remote Code Execution via malicious file upload | critical | 9.8 | 2% |
| CVE-2015-1000013 | csv2wpec-coupon (WordPress plugin) | Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1 | high | 7.8 | 2% |
| CVE-2019-7861 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Unsafe File Upload | high | 7.5 | 2% |
| CVE-2019-15866 | crelly-slider (WordPress plugin) | The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_im | high | 8.8 | 2% |
| CVE-2020-22643 | feehi/cms | Feehi CMS arbitrary file upload vulnerability | high | 7.2 | 2% |
| CVE-2015-1784 | nextgen-gallery (WordPress plugin) | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we | high | 8.8 | 2% |
| CVE-2021-24493 | shopp (WordPress plugin) | The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does n | critical | 9.8 | 2% |
| CVE-2016-10995 | telvolution (WordPress plugin) | The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php. | critical | 9.8 | 2% |
| CVE-2015-9402 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload. | high | 8.8 | 2% |
| CVE-2023-5604 | asgaros-forum (WordPress plugin) | The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecur | critical | 9.8 | 2% |
| CVE-2022-41705 | badaso/core | Badaso vulnerable to Remote Code Execution (RCE) | critical | 9.8 | 2% |
| CVE-2021-24224 | easy-form-builder-by-bitware (WordPress plugin) | The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not ha | high | 8.8 | 2% |
| CVE-2021-24253 | classyfrieds (WordPress plugin) | The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only chec | high | 8.8 | 2% |
| CVE-2021-24171 | woocommerce-upload-files (WordPress plugin) | The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was p | critical | 9.8 | 2% |
| CVE-2016-10958 | estatik (WordPress plugin) | The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php. | high | 7.5 | 2% |
| CVE-2018-3814 | craftcms/cms | Craft CMS PHP Code Injection Vulnerability | high | 8.8 | 2% |
| CVE-2017-9069 | modx/revolution | MODX Revolution allows overwriting .htaccess | high | 8.8 | 2% |
| CVE-2019-8114 | magento/community-edition, magento/project-community-edition, magento/magento1ce +2 more | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | 2% |
| CVE-2021-24254 | college-publisher-import (WordPress plugin) | The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users | high | 7.2 | 2% |
| CVE-2020-9309 | silverstripe/cms | Silverstripe CMS malicious file upload enables script execution | high | 8.8 | 2% |
| CVE-2018-9209 | fineuploader/php-traditional-server | FineUploader php-traditional-server unauthenticated arbitrary file upload vulnerability | critical | 9.8 | 2% |
| CVE-2021-23814 | unisharp/laravel-filemanager | Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager | medium | 6.7 | 2% |
| CVE-2021-34257 | wpanel/wpanel4-cms | Unrestricted Upload of File with Dangerous Type in WPanel 4 | high | 8.8 | 2% |
| CVE-2021-4354 | pwa-for-wp-\&-amp (WordPress plugin) | The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_ | high | 8.8 | 2% |
| CVE-2023-5822 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient fil | high | 8.1 | 2% |
| CVE-2020-21322 | feehi/cms | Arbitrary Code Execution in feehi/cms | high | 0.0 | 2% |
| CVE-2021-24311 | external-media (WordPress plugin) | The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via | high | 8.8 | 2% |
| CVE-2019-14467 | social-photo-gallery (WordPress plugin) | The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in th | high | 7.8 | 2% |
| CVE-2025-7340 | ht-contactform (WordPress plugin) | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file | critical | 9.8 | 2% |
| CVE-2023-6449 | contact-form-7 (WordPress plugin) | The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' f | medium | 6.6 | 2% |
| CVE-2020-9280 | silverstripe/assets, silverstripe/framework, silverstripe/userforms | SilverStripe Folders migrated from 3.x may be unsafe to upload to | high | 7.5 | 2% |
| CVE-2021-4225 | sp-project-\&-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plu | high | 8.8 | 2% |
| CVE-2021-24216 | one-stop-wp-migration (WordPress plugin) | The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload | high | 7.2 | 2% |
| CVE-2021-39317 | access-demo-importer (WordPress plugin), accesspress-basic (WordPress plugin), accesspress-lite (WordPress plugin) +40 more | A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offl | high | 8.8 | 2% |
| CVE-2023-3342 | user-registration (WordPress plugin) | The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type v | critical | 9.9 | 2% |
| CVE-2022-27862 | vikbooking (WordPress plugin) | Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to up | critical | 9.8 | 2% |
| CVE-2022-1008 | one-click-demo-import (WordPress plugin) | The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to | high | 7.2 | 2% |
| CVE-2021-24252 | event-banner (WordPress plugin) | The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, su | high | 7.2 | 2% |
| CVE-2019-15649 | insert-or-embed-articulate-content-into-wordpress (WordPress plugin) | The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload. | high | 8.8 | 2% |
| CVE-2024-9659 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.8 | 2% |
| CVE-2021-24123 | powerpress (WordPress plugin) | Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as th | high | 7.2 | 2% |
| CVE-2023-0477 | auto-featured-image (WordPress plugin) | The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Au | high | 8.8 | 2% |
| CVE-2022-3125 | frontend-file-manager (WordPress plugin) | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arb | high | 8.8 | 2% |
| CVE-2022-2594 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated | high | 8.8 | 2% |
| CVE-2021-21355 | typo3/cms, typo3/cms-core, typo3/cms-form | Unrestricted File Upload in Form Framework | high | 8.6 | 2% |
| CVE-2021-4382 | recently (WordPress plugin) | The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() | high | 8.8 | 2% |
| CVE-2021-21357 | typo3/cms, typo3/cms-core, typo3/cms-form | Broken Access Control in Form Framework | high | 8.3 | 2% |
| CVE-2023-0265 | uvdesk/community-skeleton | Uvdesk remote code execution vulnerability | high | 8.8 | 2% |
| CVE-2024-13365 | security-malware-firewall (WordPress plugin) | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and extrac | critical | 9.8 | 2% |
| CVE-2019-7912 | magento/community-edition, magento/product-community-edition | Magento Filter extension bypass via crafted store configuration keys | high | 7.2 | 2% |