Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-13646 | modula-best-grid-gallery (WordPress plugin) | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip | high | 7.5 | 1% |
| CVE-2025-5831 | droip (WordPress plugin) | The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() | high | 8.8 | 1% |
| CVE-2014-125104 | vaultpress (WordPress plugin) | A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is | medium | 6.3 | 1% |
| CVE-2023-30536 | slim/psr7 | Insecure header validation in slim/psr7 | medium | 6.5 | 1% |
| CVE-2024-13342 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_fil | high | 8.1 | 1% |
| CVE-2024-7620 | customizer-export-import (WordPress plugin) | The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_impor | medium | 6.6 | 1% |
| CVE-2026-47767 | symfony/runtime, symfony/symfony | SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch | medium | 0.0 | 1% |
| CVE-2024-4825 | cockpit-hq/cockpit | Cockpit CMS contains an arbitrary file upload vulenrability | critical | 9.8 | 1% |
| CVE-2021-34619 | woocommerce-stock-manager (WordPress plugin) | The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up t | high | 8.8 | 1% |
| CVE-2023-44763 | concrete5/concrete5 | ConcreteCMS vulnerable to Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2024-11391 | advanced-file-manager (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fm | high | 7.5 | 1% |
| CVE-2026-28502 | wwbn/avideo | AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction | critical | 0.0 | 1% |
| CVE-2024-13744 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate | high | 8.1 | 1% |
| CVE-2015-1785 | nextgen-gallery (WordPress plugin) | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we | medium | 6.5 | 1% |
| CVE-2026-40488 | openmage/magento-lts | OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution | high | 8.8 | 1% |
| CVE-2022-29254 | silverstripe/silverstripe-omnipay | Failed payment recorded has completed in Silverstripe Omnipay | low | 3.7 | 1% |
| CVE-2024-5630 | insert-or-embed-articulate-content (WordPress plugin) | The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to | high | 8.8 | 1% |
| CVE-2021-24960 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role | medium | 5.4 | 1% |
| CVE-2024-5080 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files suc | high | 8.8 | 1% |
| CVE-2026-33647 | wwbn/avideo | AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload | high | 8.8 | 1% |
| CVE-2025-52353 | badaso/core | Badaso CMS file upload vulnerability | high | 0.0 | 1% |
| CVE-2024-8746 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation v | high | 7.5 | 1% |
| CVE-2022-0950 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2021-24620 | simple-e-commerce-shopping-cart (WordPress plugin) | The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downl | high | 8.8 | 1% |
| CVE-2023-51419 | bertha-ai (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue a | critical | 10.0 | 1% |
| CVE-2022-0499 | sermon-browser (WordPress plugin) | The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate th | high | 8.8 | 1% |
| CVE-2026-41587 | ci4-cms-erp/ci4ms | CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution | high | 0.0 | 1% |
| CVE-2025-14894 | livewire-filemanager/filemanager | Livewire Filemanager does not restrict uploaded file types | high | 7.5 | 1% |
| CVE-2023-5227 | thorsten/phpmyfaq | phpMyFAQ allows unrestricted file types in image field | medium | 6.5 | 1% |
| CVE-2025-5012 | workreap (WordPress plugin) | The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due | high | 8.8 | 1% |
| CVE-2024-24754 | bref/bref | Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions | low | 3.7 | 1% |
| CVE-2025-4102 | beaver-builder (WordPress plugin) | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | high | 7.2 | 1% |
| CVE-2025-4954 | axle-demo-importer (WordPress plugin) | The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author | high | 8.8 | 1% |
| CVE-2021-4096 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it pos | high | 8.8 | 1% |
| CVE-2025-32957 | baserproject/basercms | baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE) | high | 8.7 | 1% |
| CVE-2022-29451 | rara-one-click-demo-import (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress | high | 8.8 | 1% |
| CVE-2021-34639 | download-manager (WordPress plugin) | Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extensi | high | 7.5 | 1% |
| CVE-2021-24490 | email-artillery (WordPress plugin) | The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, all | medium | 6.8 | 1% |
| CVE-2022-3771 | noumo/easyii | easyii CMS's File Upload Management vulnerable to unrestricted upload | critical | 9.8 | 1% |
| CVE-2022-3537 | role-based-pricing-for-woocommerce (WordPress plugin) | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not valida | high | 8.8 | 1% |
| CVE-2025-6206 | aiomatic (WordPress plugin) | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbit | high | 7.5 | 1% |
| CVE-2022-0912 | microweber/microweber | Unrestricted Upload of File with Dangerous Type in microweber | medium | 4.8 | 1% |
| CVE-2025-67164 | pagekit/pagekit | Pagekit CMS is vulnerable to OS Command Injection via Storage component | critical | 9.9 | 1% |
| CVE-2024-45398 | contao/core-bundle | Contao affected by remote command execution through file upload | high | 8.3 | 1% |
| CVE-2026-33687 | code16/sharp | Sharp has Unrestricted File Upload via Client-Controlled Validation Rules | high | 8.8 | 1% |
| CVE-2026-27891 | facturascripts/facturascripts | FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism | high | 7.2 | 1% |
| CVE-2024-45962 | october/october | October allows an admin account to upload PDF containing malicious JavaScript | medium | 4.8 | 1% |
| CVE-2024-50496 | ar (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to | critical | 10.0 | 1% |
| CVE-2026-53599 | redaxo/source | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extensio | high | 7.5 | 1% |
| CVE-2025-24013 | codeigniter4/framework | Missing validation of header name and value in codeigniter4/framework | medium | 5.3 | 1% |