Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24248 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported fi | high | 7.2 | 2% |
| CVE-2018-25019 | learndash (WordPress plugin) | The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_a | high | 7.5 | 2% |
| CVE-2024-3022 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpress_p | high | 7.2 | 2% |
| CVE-2022-3076 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any | high | 7.2 | 2% |
| CVE-2023-6635 | block-options (WordPress plugin) | The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' funct | high | 7.2 | 2% |
| CVE-2023-25654 | baserproject/basercms | baserCMS File Uploader Remote Code Execution (RCE) vulnerability | critical | 9.8 | 2% |
| CVE-2023-38887 | dolibarr/dolibarr | File Upload vulnerability in Dolibarr ERP CRM | high | 8.8 | 2% |
| CVE-2023-1406 | jetengine-for-elementor (WordPress plugin) | The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a | high | 8.8 | 2% |
| CVE-2020-36701 | kingcomposer (WordPress plugin) | The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the | high | 8.8 | 2% |
| CVE-2021-4330 | envato-elements (WordPress plugin), template-kit---import (WordPress plugin) | The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient | high | 8.8 | 2% |
| CVE-2022-0537 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS | high | 7.2 | 2% |
| CVE-2024-7772 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' f | critical | 9.8 | 2% |
| CVE-2022-46157 | akeneo/pim-community-dev | Akeneo PIM Community Edition vulnerable to remote php code execution | high | 8.8 | 2% |
| CVE-2022-36386 | wp-all-import (WordPress plugin) | Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. | critical | 9.1 | 1% |
| CVE-2021-24663 | simple-schools-staff-directory (WordPress plugin) | The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, a | high | 7.2 | 1% |
| CVE-2020-26255 | getkirby/cms, getkirby/panel | Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5 | medium | 6.8 | 1% |
| CVE-2024-1311 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages | high | 8.8 | 1% |
| CVE-2025-5058 | store-manager-connector (WordPress plugin) | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.8 | 1% |
| CVE-2023-6925 | unlimited-addons-for-wpbakery-page-builder (WordPress plugin) | The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type va | high | 7.2 | 1% |
| CVE-2022-1034 | showdoc/showdoc | Unrestricted Upload of File with Dangerous Type in ShowDoc | high | 7.2 | 1% |
| CVE-2024-28105 | phpmyfaq/phpmyfaq | phpMyFAQ's File Upload Bypass at Category Image Leads to RCE | high | 7.2 | 1% |
| CVE-2021-4080 | bytefury/crater | crater is vulnerable to Unrestricted Upload of File with Dangerous Type | high | 8.8 | 1% |
| CVE-2021-25119 | automatic-grid-image-listing (WordPress plugin) | The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file ty | high | 7.2 | 1% |
| CVE-2022-1273 | import-wp (WordPress plugin) | The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin t | high | 7.2 | 1% |
| CVE-2022-1409 | hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users suc | high | 7.2 | 1% |
| CVE-2019-11807 | woocommerce-checkout-manager (WordPress plugin) | The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachm | high | 7.5 | 1% |
| CVE-2022-0687 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to | high | 8.8 | 1% |
| CVE-2022-23043 | tribalsystems/zenario | File upload restriction bypass in Zenario CMS | high | 7.2 | 1% |
| CVE-2017-9840 | dolibarr/dolibarr | Dolibarr ERP and CRM Unsafe File Upload Vulnerability | high | 8.8 | 1% |
| CVE-2022-1939 | allow-svg-files (WordPress plugin) | The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as ad | high | 7.2 | 1% |
| CVE-2022-0440 | catch-themes-demo-import (WordPress plugin) | The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivil | high | 7.2 | 1% |
| CVE-2023-6316 | mw-wp-form (WordPress plugin) | The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_up | critical | 9.8 | 1% |
| CVE-2025-4336 | store-manager-connector (WordPress plugin) | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | high | 8.1 | 1% |
| CVE-2022-25277 | drupal/core | *Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers.* Drupal core sanitizes filenames w | high | 7.2 | 1% |
| CVE-2022-2268 | wp-all-import (WordPress plugin) | The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without valida | high | 7.2 | 1% |
| CVE-2022-0242 | bytefury/crater | Unrestricted Upload of File with Dangerous Type in Crater | high | 7.2 | 1% |
| CVE-2023-29384 | jobwp (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue aff | critical | 10.0 | 1% |
| CVE-2019-16318 | pimcore/pimcore | Pimcore Unrestricted Upload of File with Dangerous Type | high | 8.8 | 1% |
| CVE-2023-6220 | piotnetforms (WordPress plugin) | The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetforms | high | 8.1 | 1% |
| CVE-2021-41745 | showdoc/showdoc | Showdoc File Upload Vulnerability | critical | 9.8 | 1% |
| CVE-2015-9338 | wp-file-upload (WordPress plugin) | The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files. | high | 7.5 | 1% |
| CVE-2015-9339 | wp-file-upload (WordPress plugin) | The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files. | high | 7.5 | 1% |
| CVE-2015-9340 | wp-file-upload (WordPress plugin) | The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, | high | 7.5 | 1% |
| CVE-2015-9341 | wp-file-upload (WordPress plugin) | The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files. | high | 7.5 | 1% |
| CVE-2020-13675 | drupal/core, drupal/graphql | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all | critical | 9.8 | 1% |
| CVE-2017-18592 | woocommerce-catalog-enquiry (WordPress plugin) | The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads. | high | 7.5 | 1% |
| CVE-2024-3962 | woocommerce-product-addon (WordPress plugin) | The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.8 | 1% |
| CVE-2023-6558 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validat | high | 7.2 | 1% |
| CVE-2024-27923 | getgrav/grav | Remote Code Execution by uploading a phar file using frontmatter | high | 8.8 | 1% |
| CVE-2026-45140 | chamilo/chamilo-lms | Chamilo LMS CStudio upload flow allows unauthenticated remote code execution | critical | 9.8 | 1% |