Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10962 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0. | high | 8.8 | 1% |
| CVE-2022-2439 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted i | high | 7.2 | 1% |
| CVE-2022-45077 | betheme (WordPress plugin) | Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress. | medium | 6.3 | 1% |
| CVE-2024-13824 | ciyashop (WordPress plugin) | The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including | critical | 9.8 | 1% |
| CVE-2026-55220 | pimcore/pimcore | Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) | critical | 0.0 | 1% |
| CVE-2024-13899 | mambo-joomla-importer (WordPress plugin) | The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization | high | 7.2 | 1% |
| CVE-2024-4371 | woolementor (WordPress plugin) | The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PH | critical | 9.0 | 1% |
| CVE-2025-0428 | aipower (WordPress plugin) | The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via des | high | 7.2 | 1% |
| CVE-2025-0429 | aipower (WordPress plugin) | The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via des | high | 7.2 | 1% |
| CVE-2026-45077 | symfony/monolog-bridge, symfony/symfony | Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener | high | 0.0 | 1% |
| CVE-2024-13777 | zoomsounds (WordPress plugin) | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, | high | 8.1 | 1% |
| CVE-2021-4451 | ninjafirewall (WordPress plugin) | The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This all | medium | 6.6 | 1% |
| CVE-2026-25524 | openmage/magento-lts | OpenMage LTS: Phar Deserialization leads to Remote Code Execution | high | 8.1 | 1% |
| CVE-2025-2689 | yiisoft/yii2-dev | yiisoft Yii2 Deserialization of Untrusted Data | medium | 6.3 | 1% |
| CVE-2026-33942 | saloonphp/saloon | Saloon has insecure deserialization in AccessTokenAuthenticator | high | 0.0 | 1% |
| CVE-2024-7432 | unseen-blog (WordPress plugin) | The Unseen Blog theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of | high | 8.8 | 1% |
| CVE-2024-7433 | empowerment (WordPress plugin) | The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of | high | 8.8 | 1% |
| CVE-2026-3452 | concrete5/concrete5 | Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection | high | 0.0 | 1% |
| CVE-2025-0724 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, an | high | 8.8 | 1% |
| CVE-2022-3568 | imagemagick-engine (WordPress plugin) | The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up | high | 8.8 | 1% |
| CVE-2024-52306 | backpack/filemanager | FileManager Deserialization of Untrusted Data vulnerability | high | 7.6 | 1% |
| CVE-2024-5724 | photo-video-gallery-master (WordPress plugin) | The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via de | high | 8.8 | 1% |
| CVE-2024-7434 | ultrapress (WordPress plugin) | The UltraPress theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.2 via deserialization of | high | 8.8 | 1% |
| CVE-2024-2694 | betheme (WordPress plugin) | The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of un | high | 8.8 | 1% |
| CVE-2023-52182 | ari-stream-quiz (WordPress plugin) | Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – | critical | 9.9 | 1% |
| CVE-2024-7351 | simple-job-board (WordPress plugin) | The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserializa | high | 7.2 | 1% |
| CVE-2025-2485 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, | high | 7.5 | 1% |
| CVE-2024-13556 | affiliate-links (WordPress plugin) | The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in al | high | 8.1 | 1% |
| CVE-2025-6742 | sureforms (WordPress plugin) | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a | high | 7.5 | 1% |
| CVE-2024-13831 | wc-tabs (WordPress plugin) | The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserial | high | 7.2 | 1% |
| CVE-2022-2446 | wp-editor (WordPress plugin) | The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up | high | 7.2 | 1% |
| CVE-2025-6464 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all ve | high | 7.5 | 1% |
| CVE-2026-29782 | devcode-it/openstamanager | OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2 | high | 7.2 | 1% |
| CVE-2022-3536 | role-based-pricing-for-woocommerce (WordPress plugin) | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not | high | 8.8 | 1% |
| CVE-2023-49826 | soledad (WordPress plugin) | Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This is | high | 8.1 | 1% |
| CVE-2023-5235 | ovic-responsive-wpbakery (WordPress plugin) | The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which m | high | 8.8 | 1% |
| CVE-2023-51700 | unofficial-mobile-bankid-integration (WordPress plugin) | Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior | medium | 6.4 | 1% |
| CVE-2025-9083 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform P | critical | 9.8 | 1% |
| CVE-2022-47599 | file-manager (WordPress plugin) | Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin | medium | 5.5 | 1% |
| CVE-2024-47836 | admidio/admidio | Admidio Vulnerable to HTML Injection In The Messages Section | low | 3.5 | 1% |
| CVE-2024-24796 | event-manager-and-tickets-selling-for-woocommerce (WordPress plugin) | Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – Wo | high | 8.2 | 0% |
| CVE-2025-2939 | ninja-tables (WordPress plugin) | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, | medium | 5.6 | 0% |
| CVE-2024-3591 | geo-controller (WordPress plugin) | The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow | medium | 6.5 | 0% |
| CVE-2026-35537 | roundcube/roundcubemail | Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler | low | 3.7 | 0% |
| CVE-2026-8135 | concrete5/concrete5 | Concrete CMS Vulnerable to Deserialization of Untrusted Data | high | 0.0 | 0% |
| CVE-2026-45034 | phpoffice/phpspreadsheet | PHPSpreadsheet has a patch bypass for CVE-2026-34084 | critical | 0.0 | 0% |
| CVE-2024-29800 | timber/timber | timber/timber vulnerable to Deserialization of Untrusted Data | high | 8.0 | 0% |
| CVE-2024-5649 | fusion-slider (WordPress plugin) | The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserializat | medium | 5.4 | 0% |
| CVE-2026-8727 | tomasnorre/crawler | TYPO3 Remote Code Execution in extension "Site Crawler" (crawler) | high | 0.0 | 0% |
| CVE-2026-24765 | phpunit/phpunit | PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling | high | 7.8 | 0% |