Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3962 | woocommerce-product-addon (WordPress plugin) | The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.8 | 1% |
| CVE-2023-6558 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validat | high | 7.2 | 1% |
| CVE-2024-27923 | getgrav/grav | Remote Code Execution by uploading a phar file using frontmatter | high | 8.8 | 1% |
| CVE-2026-45140 | chamilo/chamilo-lms | Chamilo LMS CStudio upload flow allows unauthenticated remote code execution | critical | 9.8 | 1% |
| CVE-2020-21174 | feehi/cms | liufee CMS File Upload vulnerability | critical | 9.8 | 1% |
| CVE-2020-21489 | feehi/cms | Liufee CMS File Upload vulnerability | critical | 9.8 | 1% |
| CVE-2022-25602 | responsive-menu (WordPress plugin) | Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPr | high | 8.3 | 1% |
| CVE-2023-3295 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing | high | 8.8 | 1% |
| CVE-2020-5255 | symfony/http-foundation, symfony/symfony | Prevent cache poisoning via a Response Content-Type header in Symfony | low | 2.6 | 1% |
| CVE-2019-8093 | magento/community-edition, magento/product-community-edition | Magento Information Disclosure via File upload functionality | high | 8.8 | 1% |
| CVE-2024-6823 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the m | high | 8.8 | 1% |
| CVE-2024-1205 | wemanage-app-worker (WordPress plugin) | The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulne | high | 8.8 | 1% |
| CVE-2022-34154 | enable-svg-webp-ico-upload (WordPress plugin) | Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 | high | 7.2 | 1% |
| CVE-2024-1986 | woocommerce-jetpack (WordPress plugin) | The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc | high | 8.8 | 1% |
| CVE-2022-34971 | feehi/cms | Feehi CMS arbitrary code execution via crafted PHP file | high | 8.8 | 1% |
| CVE-2023-6636 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val | high | 7.2 | 1% |
| CVE-2023-6826 | e2pdf (WordPress plugin) | The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' funct | high | 7.2 | 1% |
| CVE-2023-6827 | essential-real-estate (WordPress plugin) | The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajax | high | 7.5 | 1% |
| CVE-2025-6586 | download-plugin (WordPress plugin) | The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_loc | high | 7.2 | 1% |
| CVE-2022-0403 | library-file-manager (WordPress plugin) | The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by | high | 8.1 | 1% |
| CVE-2020-21516 | feehi/cms | FeehiCMS has an arbitrary file upload vulnerability | critical | 9.8 | 1% |
| CVE-2024-38529 | admidio/admidio | Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment | critical | 9.0 | 1% |
| CVE-2025-6085 | integromat-connector (WordPress plugin) | The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_med | high | 7.2 | 1% |
| CVE-2017-1000194 | october/october | October CMS File Upload Vulnerability | critical | 9.8 | 1% |
| CVE-2021-41231 | openmage/magento-lts | DataFlow upload remote code execution vulnerability | high | 7.2 | 1% |
| CVE-2023-6219 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpress_proce | high | 7.2 | 1% |
| CVE-2024-1069 | contact-form-entries (WordPress plugin) | The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' | high | 7.2 | 1% |
| CVE-2023-29197 | guzzlehttp/psr7 | Improper header name validation in guzzlehttp/psr7 | medium | 5.3 | 1% |
| CVE-2024-0699 | ai-engine (WordPress plugin) | The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing | medium | 6.6 | 1% |
| CVE-2021-28931 | forkcms/forkcms | Arbitrary file upload in Fork CMS | high | 8.8 | 1% |
| CVE-2022-36285 | uploading-svgwebp-and-ico-files (WordPress plugin) | Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress. | high | 7.2 | 1% |
| CVE-2024-10820 | woocommerce-upload-files (WordPress plugin) | The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_ | critical | 9.8 | 1% |
| CVE-2022-1538 | theme-demo-import (WordPress plugin) | Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload a | high | 7.2 | 1% |
| CVE-2024-9942 | wordpress-gym-management-system (WordPress plugin) | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.8 | 1% |
| CVE-2021-26642 | xpressengine/xpressengine | XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type | critical | 9.8 | 1% |
| CVE-2020-36842 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on t | high | 8.8 | 1% |
| CVE-2024-1468 | avada (WordPress theme) | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type | high | 8.8 | 1% |
| CVE-2013-4250 | typo3/cms | TYPO3 doesn't properly check file extensions | high | 0.0 | 1% |
| CVE-2015-10087 | designfolio-plus (WordPress plugin) | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in UpThemes Theme DesignFolio Plus 1.2 on WordPress and classified as problem | medium | 6.3 | 1% |
| CVE-2024-8066 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' | high | 7.5 | 1% |
| CVE-2023-6979 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the | high | 8.8 | 1% |
| CVE-2024-1567 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in t | high | 8.2 | 1% |
| CVE-2018-0571 | baserproject/basercms | baserCMS arbitrary file upload vulnerability | medium | 4.3 | 1% |
| CVE-2023-47129 | statamic/cms | Statamic CMS remote code execution via front-end form uploads | high | 8.3 | 1% |
| CVE-2024-5441 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featu | high | 8.8 | 1% |
| CVE-2022-0263 | pimcore/pimcore | Unrestricted Upload of File with Dangerous Type in pimcore | high | 7.8 | 1% |
| CVE-2019-19745 | contao/contao, contao/core-bundle | Unrestricted file uploads in Contao | high | 8.8 | 1% |
| CVE-2022-24749 | sylius/sylius | Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius | medium | 6.1 | 1% |
| CVE-2016-10959 | estatik (WordPress plugin) | The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-ad | medium | 6.5 | 1% |
| CVE-2023-48217 | statamic/cms | Statamic CMS vulnerable to remote code execution via form uploads | high | 8.8 | 1% |