Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-36097 | funadmin/funadmin | fuadmin vulnerable to insecure file upload | critical | 9.8 | 1% |
| CVE-2017-20063 | elefant/cms | Unrestricted Upload of File with Dangerous Type in Elefant CMS | high | 8.8 | 1% |
| CVE-2024-8615 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch | critical | 10.0 | 1% |
| CVE-2023-6133 | forminator (WordPress plugin) | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime | medium | 6.6 | 1% |
| CVE-2024-12853 | modula-best-grid-gallery (WordPress plugin) | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload | high | 8.8 | 1% |
| CVE-2024-3229 | salon-booking-system (WordPress plugin) | The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_ | critical | 9.8 | 1% |
| CVE-2024-10627 | woocommerce-support-ticket-system (WordPress plugin) | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th | critical | 9.8 | 1% |
| CVE-2024-13091 | wpot (WordPress plugin) | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcl | critical | 9.8 | 1% |
| CVE-2022-0960 | showdoc/showdoc | Cross-site Scripting in showdoc/showdoc | critical | 9.0 | 1% |
| CVE-2024-7559 | file-manager-pro (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks | high | 8.8 | 1% |
| CVE-2025-2780 | woffice (WordPress plugin) | The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validatio | high | 8.8 | 1% |
| CVE-2024-47823 | livewire/livewire | Livewire Remote Code Execution on File Uploads | high | 7.5 | 1% |
| CVE-2024-13908 | bws-smtp (WordPress plugin) | The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_option | high | 7.2 | 1% |
| CVE-2021-24981 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP | high | 7.5 | 1% |
| CVE-2023-7061 | file-manager-advanced-shortcode (WordPress plugin) | The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5. | high | 8.8 | 1% |
| CVE-2023-5931 | rtmedia (WordPress plugin) | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow a | high | 8.8 | 1% |
| CVE-2024-40400 | automad/automad | Automad arbitrary file upload vulnerability | medium | 6.8 | 1% |
| CVE-2024-5450 | bug-library (WordPress plugin) | The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user t | critical | 9.1 | 1% |
| CVE-2026-63223 | codeigniter4/framework | CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules | critical | 9.8 | 1% |
| CVE-2024-8614 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch | critical | 9.9 | 1% |
| CVE-2022-0472 | jsdecena/laracom | Unrestricted Upload of File with Dangerous Type in jsdecena/laracom | medium | 5.4 | 1% |
| CVE-2024-5853 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.9 | 1% |
| CVE-2025-11456 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file typ | critical | 9.8 | 1% |
| CVE-2024-6054 | auto-featured-image (WordPress plugin) | The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post | high | 8.8 | 1% |
| CVE-2024-6756 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_pos | high | 8.8 | 1% |
| CVE-2022-38140 | seo-plugin-by-squirrly-seo (WordPress plugin) | Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress. | high | 7.6 | 1% |
| CVE-2024-8242 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing f | medium | 4.3 | 1% |
| CVE-2022-3912 | user-registration (WordPress plugin) | The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to bo | high | 7.5 | 1% |
| CVE-2021-3846 | grumpydictator/firefly-iii | Unrestricted File Upload vulnerability in Firefly III | high | 8.8 | 1% |
| CVE-2026-48062 | codeigniter4/framework | CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule | critical | 9.8 | 1% |
| CVE-2025-46001 | simogeo/filemanager | simogeo/filemanager arbitrary file upload vulnerability | critical | 9.8 | 1% |
| CVE-2025-6057 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() f | high | 8.8 | 1% |
| CVE-2025-5061 | wp-import-export-lite (WordPress plugin) | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_pars | high | 7.5 | 1% |
| CVE-2019-8140 | magento/community-edition, magento/product-community-edition | Magento Unrestricted file upload vulnerability | medium | 4.9 | 1% |
| CVE-2022-1411 | yetiforce/yetiforce-crm | Unrestricted Upload of File with Dangerous Type in yetiforce-crm | medium | 6.1 | 1% |
| CVE-2024-37821 | dolibarr/dolibarr | Dolibarr arbitrary file upload vulnerability | high | 8.8 | 1% |
| CVE-2024-13882 | aiomatic (WordPress plugin) | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbit | high | 8.8 | 1% |
| CVE-2024-13418 | april (WordPress plugin), auteur (WordPress plugin), benaa (WordPress plugin) +1 more | Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFon | high | 8.8 | 1% |
| CVE-2011-10004 | reciply (WordPress plugin) | A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown process | medium | 6.3 | 1% |
| CVE-2025-6207 | wp-import-export-lite (WordPress plugin) | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_temp | high | 7.5 | 1% |
| CVE-2025-5322 | vikrentcar (WordPress plugin) | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | high | 7.2 | 1% |
| CVE-2024-8294 | feehi/cms | FeehiCMS file upload vulnerability | medium | 6.3 | 1% |
| CVE-2024-8295 | feehi/cms | FeehiCMS BannerForm[img] unrestricted upload | medium | 6.3 | 1% |
| CVE-2024-8296 | feehi/cms | FeehiCMS User[avatar] unrestricted upload | medium | 6.3 | 1% |
| CVE-2025-13646 | modula-best-grid-gallery (WordPress plugin) | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip | high | 7.5 | 1% |
| CVE-2025-5831 | droip (WordPress plugin) | The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() | high | 8.8 | 1% |
| CVE-2014-125104 | vaultpress (WordPress plugin) | A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is | medium | 6.3 | 1% |
| CVE-2024-13342 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_fil | high | 8.1 | 1% |
| CVE-2024-7620 | customizer-export-import (WordPress plugin) | The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_impor | medium | 6.6 | 1% |
| CVE-2024-4825 | cockpit-hq/cockpit | Cockpit CMS contains an arbitrary file upload vulenrability | critical | 9.8 | 1% |