Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0255 | enable-media-replace (WordPress plugin) | The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow | high | 8.8 | 1% |
| CVE-2023-5673 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attac | high | 8.8 | 1% |
| CVE-2023-6140 | essential-real-estate (WordPress plugin) | The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from m | high | 8.8 | 1% |
| CVE-2025-6220 | ultimate-addons-for-contact-form-7 (WordPress plugin) | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the | high | 7.2 | 1% |
| CVE-2023-5601 | woocommerce-ninja-forms-product-add-ons (WordPress plugin) | The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenti | critical | 9.8 | 1% |
| CVE-2023-48966 | zoujingli/thinkadmin | ThinkAdmin arbitrary file upload vulnerability | high | 8.8 | 1% |
| CVE-2023-25655 | baserproject/basercms | baserCMS allows any file to be uploaded | critical | 9.8 | 1% |
| CVE-2025-0357 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_contr | critical | 9.8 | 1% |
| CVE-2017-6931 | drupal/core, drupal/drupal | Drupal Settings Tray access bypass | medium | 6.5 | 1% |
| CVE-2024-7770 | file-manager (WordPress plugin) | The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary fi | high | 8.8 | 1% |
| CVE-2021-41938 | shopxo/shopxo | Arbitrary file upload in ShopXO | high | 7.2 | 1% |
| CVE-2022-40217 | wpide (WordPress plugin) | Authenticated (admin+) Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. | medium | 6.5 | 1% |
| CVE-2024-9660 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | high | 8.8 | 1% |
| CVE-2018-0587 | ultimate-member (WordPress plugin) | Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to u | medium | 4.3 | 1% |
| CVE-2024-13359 | product-input-fields-for-woocommerce (WordPress plugin) | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validati | high | 8.1 | 1% |
| CVE-2023-4536 | my-account-page-editor (WordPress plugin) | The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated us | high | 8.8 | 1% |
| CVE-2024-4397 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th | high | 8.8 | 1% |
| CVE-2023-5860 | icons-font-loader (WordPress plugin) | The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload functio | high | 7.2 | 1% |
| CVE-2023-47621 | doublethreedigital/guest-entries, duncanmcclean/guest-entries | Guest Entries Remote code execution via file uploads | high | 8.8 | 1% |
| CVE-2026-32756 | admidio/admidio | File Upload(RCE) Vulnerability in admidio | high | 8.8 | 1% |
| CVE-2023-1970 | yuan1994/tpadmin | yuan1994 tpAdmin Unrestricted Upload of File with Dangerous Type vulnerability | high | 7.2 | 1% |
| CVE-2022-42698 | api2cart-bridge-connector (WordPress plugin) | Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress. | critical | 9.8 | 1% |
| CVE-2023-3692 | admidio/admidio | Admidio vulnerable to Unrestricted Upload of File with Dangerous Type | medium | 6.7 | 1% |
| CVE-2022-2046 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but | medium | 4.9 | 1% |
| CVE-2024-31210 | WordPress core | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plug | high | 7.6 | 1% |
| CVE-2022-2356 | user-private-files (WordPress plugin) | The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the ser | high | 8.8 | 1% |
| CVE-2023-41564 | cockpit-hq/cockpit | Cockpit CMS arbitrary file upload vulnerability | medium | 6.1 | 1% |
| CVE-2023-1313 | cockpit-hq/cockpit | cockpit-hq/cockpit is vulnerable to unrestricted file uploads | high | 8.8 | 1% |
| CVE-2023-4311 | vrm360 (WordPress plugin) | The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin sho | high | 8.8 | 1% |
| CVE-2022-40200 | wpforo (WordPress plugin) | Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. | critical | 9.9 | 1% |
| CVE-2025-2512 | file-away (WordPress plugin) | The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validatio | critical | 9.8 | 1% |
| CVE-2024-9307 | mfolio-lite (WordPress plugin) | The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1 | critical | 9.9 | 1% |
| CVE-2024-3242 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the valida | high | 8.8 | 1% |
| CVE-2023-0924 | popup (WordPress plugin) | The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged | high | 7.2 | 1% |
| CVE-2021-3915 | ssddanbrown/bookstack | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type | high | 7.6 | 1% |
| CVE-2023-0714 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in | high | 8.1 | 1% |
| CVE-2024-7384 | acymailing (WordPress plugin) | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitra | high | 7.5 | 1% |
| CVE-2024-8126 | file-manager-advanced (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all version | high | 7.5 | 1% |
| CVE-2020-14961 | concrete5/concrete5 | Unrestricted Uploads in Concrete5 | medium | 5.3 | 1% |
| CVE-2022-0409 | showdoc/showdoc | Unrestricted Upload of File with Dangerous Type in showdoc | high | 7.8 | 1% |
| CVE-2025-54082 | manogi/nova-tiptap, marshmallow/nova-tiptap | nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability | critical | 0.0 | 1% |
| CVE-2024-6318 | imgspider (WordPress plugin) | The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' func | high | 8.8 | 1% |
| CVE-2024-6319 | imgspider (WordPress plugin) | The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in a | high | 8.8 | 1% |
| CVE-2024-0757 | insert-or-embed-articulate-content (WordPress plugin) | The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowe | medium | 5.4 | 1% |
| CVE-2024-7484 | crm-perks-forms (WordPress plugin) | The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded | high | 7.2 | 1% |
| CVE-2026-54177 | backpack/crud | Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver | medium | 6.6 | 1% |
| CVE-2024-13333 | file-manager-advanced (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local | high | 7.5 | 1% |
| CVE-2024-2381 | ali2woo-lite (WordPress plugin) | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati | high | 8.8 | 1% |
| CVE-2024-10960 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploa | critical | 9.9 | 1% |
| CVE-2026-25510 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor | critical | 9.9 | 1% |