Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12562 | s2member (WordPress plugin) | The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization | critical | 9.8 | 1% |
| CVE-2024-25117 | phenx/php-svg-lib | php-svg-lib lacks path validation on font through SVG inline styles | medium | 6.8 | 1% |
| CVE-2024-55636 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2023-6049 | estatik (WordPress plugin) | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthentica | critical | 9.8 | 1% |
| CVE-2023-46154 | e2pdf (WordPress plugin) | Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To P | medium | 6.6 | 1% |
| CVE-2022-33900 | easy-digital-downloads (WordPress plugin) | PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress. | medium | 4.1 | 1% |
| CVE-2024-0825 | vimeography (WordPress plugin) | The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | high | 8.8 | 1% |
| CVE-2025-1913 | product-import-export-for-woo (WordPress plugin) | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in al | high | 7.2 | 1% |
| CVE-2024-48112 | topthink/thinkphp | ThinkPHP deserialization vulnerability | critical | 9.8 | 1% |
| CVE-2023-2500 | go-pricing (WordPress plugin) | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and inclu | high | 8.8 | 1% |
| CVE-2024-13742 | worpit-admin-dashboard-plugin (WordPress plugin) | The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inclu | critical | 9.8 | 1% |
| CVE-2023-4386 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization | high | 8.1 | 1% |
| CVE-2025-3623 | uncanny-automator (WordPress plugin) | The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deseriali | critical | 9.1 | 1% |
| CVE-2023-7064 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and incl | high | 7.5 | 1% |
| CVE-2020-12469 | intelliants/subrion | Subrion CMS PHP Object Injection | medium | 6.5 | 1% |
| CVE-2025-48200 | sjbr/sr-feuser-register | The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution | critical | 10.0 | 1% |
| CVE-2024-1731 | auto-refresh-single-page (WordPress plugin) | The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deseri | high | 8.8 | 1% |
| CVE-2024-1895 | event-monster (WordPress plugin) | The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all vers | high | 7.5 | 1% |
| CVE-2024-36528 | nukeviet/nukeviet | nukeviet Deserialization of Untrusted Data vulnerability | high | 8.8 | 1% |
| CVE-2024-9314 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, | high | 7.2 | 1% |
| CVE-2026-27206 | zumba/json-serializer | Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize() | high | 8.1 | 1% |
| CVE-2024-55637 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2024-13770 | puzzles (WordPress plugin) | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all version | high | 8.1 | 1% |
| CVE-2024-1859 | slider-responsive-slideshow (WordPress plugin) | The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions | high | 8.8 | 1% |
| CVE-2025-7504 | friends (WordPress plugin) | The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_ | high | 7.5 | 1% |
| CVE-2024-13789 | ravpage (WordPress plugin) | The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via deserialization of unt | critical | 9.8 | 1% |
| CVE-2024-10079 | easy-post-types (WordPress plugin) | The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserializatio | high | 8.8 | 1% |
| CVE-2024-8922 | enquiry-quotation-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce, WooCommerce product catalog plugin for WordPress is vulnerable to PHP Object Injection in all versions | high | 8.8 | 1% |
| CVE-2025-2105 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserializati | high | 8.1 | 1% |
| CVE-2024-5085 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1. | high | 8.1 | 1% |
| CVE-2024-1685 | social-media-builder (WordPress plugin) | The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via de | high | 8.8 | 1% |
| CVE-2024-3018 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 v | high | 8.8 | 1% |
| CVE-2026-61701 | cesargb/laravel-magiclink | MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution | high | 8.8 | 1% |
| CVE-2025-1971 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2 | high | 7.2 | 1% |
| CVE-2025-48951 | auth0/auth0-php | Auth0-PHP SDK Deserialization of Untrusted Data vulnerability | critical | 0.0 | 1% |
| CVE-2024-8016 | events-calendar-pro (WordPress plugin) | The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deseriali | critical | 9.1 | 1% |
| CVE-2022-2440 | theme-editor (WordPress plugin) | The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to | high | 7.2 | 1% |
| CVE-2017-20206 | appointments (WordPress plugin) | The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of u | critical | 9.8 | 1% |
| CVE-2017-20207 | flickr-gallery (WordPress plugin) | The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of | critical | 9.8 | 1% |
| CVE-2025-43960 | vrana/adminer | Adminer PHP Object Injection issue leads to Denial of Service | high | 8.6 | 1% |
| CVE-2026-49286 | pontedilana/php-weasyprint | PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass) | high | 8.1 | 1% |
| CVE-2024-9664 | wp-all-import (WordPress plugin) | The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserializa | high | 7.2 | 1% |
| CVE-2026-34084 | phpoffice/phpspreadsheet | PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled | critical | 0.0 | 1% |
| CVE-2024-13921 | order-export-\&-order-import-for-woocommerce (WordPress plugin) | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includ | high | 7.2 | 1% |
| CVE-2024-7435 | attire (WordPress plugin) | The Attire theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.6 via deserialization of untr | high | 8.8 | 1% |
| CVE-2017-20208 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Obje | critical | 9.8 | 1% |
| CVE-2023-1405 | formidable-forms (WordPress plugin) | The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection | high | 7.5 | 1% |
| CVE-2024-12721 | wb-custom-product-tabs-for-woocommerce (WordPress plugin) | The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2 | high | 7.2 | 1% |
| CVE-2024-5871 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via de | critical | 9.8 | 1% |
| CVE-2024-4157 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object I | high | 7.5 | 1% |