Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-34619 | woocommerce-stock-manager (WordPress plugin) | The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up t | high | 8.8 | 1% |
| CVE-2023-44763 | concrete5/concrete5 | ConcreteCMS vulnerable to Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2024-11391 | advanced-file-manager (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fm | high | 7.5 | 1% |
| CVE-2026-28502 | wwbn/avideo | AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction | critical | 0.0 | 1% |
| CVE-2024-13744 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate | high | 8.1 | 1% |
| CVE-2015-1785 | nextgen-gallery (WordPress plugin) | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we | medium | 6.5 | 1% |
| CVE-2026-40488 | openmage/magento-lts | OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution | high | 8.8 | 1% |
| CVE-2024-5630 | insert-or-embed-articulate-content (WordPress plugin) | The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to | high | 8.8 | 1% |
| CVE-2021-24960 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role | medium | 5.4 | 1% |
| CVE-2024-5080 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files suc | high | 8.8 | 1% |
| CVE-2026-33647 | wwbn/avideo | AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload | high | 8.8 | 1% |
| CVE-2025-52353 | badaso/core | Badaso CMS file upload vulnerability | high | 0.0 | 1% |
| CVE-2024-8746 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation v | high | 7.5 | 1% |
| CVE-2022-0950 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2021-24620 | simple-e-commerce-shopping-cart (WordPress plugin) | The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downl | high | 8.8 | 1% |
| CVE-2023-51419 | bertha-ai (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue a | critical | 10.0 | 1% |
| CVE-2022-0499 | sermon-browser (WordPress plugin) | The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate th | high | 8.8 | 1% |
| CVE-2026-41587 | ci4-cms-erp/ci4ms | CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution | high | 0.0 | 1% |
| CVE-2025-14894 | livewire-filemanager/filemanager | Livewire Filemanager does not restrict uploaded file types | high | 7.5 | 1% |
| CVE-2023-5227 | thorsten/phpmyfaq | phpMyFAQ allows unrestricted file types in image field | medium | 6.5 | 1% |
| CVE-2025-5012 | workreap (WordPress plugin) | The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due | high | 8.8 | 1% |
| CVE-2025-4102 | beaver-builder (WordPress plugin) | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | high | 7.2 | 1% |
| CVE-2025-4954 | axle-demo-importer (WordPress plugin) | The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author | high | 8.8 | 1% |
| CVE-2021-4096 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it pos | high | 8.8 | 1% |
| CVE-2025-32957 | baserproject/basercms | baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE) | high | 8.7 | 1% |
| CVE-2022-29451 | rara-one-click-demo-import (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress | high | 8.8 | 1% |
| CVE-2021-34639 | download-manager (WordPress plugin) | Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extensi | high | 7.5 | 1% |
| CVE-2021-24490 | email-artillery (WordPress plugin) | The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, all | medium | 6.8 | 1% |
| CVE-2022-3771 | noumo/easyii | easyii CMS's File Upload Management vulnerable to unrestricted upload | critical | 9.8 | 1% |
| CVE-2022-3537 | role-based-pricing-for-woocommerce (WordPress plugin) | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not valida | high | 8.8 | 1% |
| CVE-2025-6206 | aiomatic (WordPress plugin) | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbit | high | 7.5 | 1% |
| CVE-2022-0912 | microweber/microweber | Unrestricted Upload of File with Dangerous Type in microweber | medium | 4.8 | 1% |
| CVE-2025-67164 | pagekit/pagekit | Pagekit CMS is vulnerable to OS Command Injection via Storage component | critical | 9.9 | 1% |
| CVE-2024-45398 | contao/core-bundle | Contao affected by remote command execution through file upload | high | 8.3 | 1% |
| CVE-2026-33687 | code16/sharp | Sharp has Unrestricted File Upload via Client-Controlled Validation Rules | high | 8.8 | 1% |
| CVE-2026-27891 | facturascripts/facturascripts | FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism | high | 7.2 | 1% |
| CVE-2024-45962 | october/october | October allows an admin account to upload PDF containing malicious JavaScript | medium | 4.8 | 1% |
| CVE-2024-50496 | ar (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to | critical | 10.0 | 1% |
| CVE-2026-53599 | redaxo/source | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extensio | high | 7.5 | 1% |
| CVE-2021-36573 | feehi/feehicms | FeehiCMS Unrestricted Upload vulnerability | medium | 5.4 | 0% |
| CVE-2023-5953 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF | high | 8.8 | 0% |
| CVE-2025-55743 | unopim/unopim | UnoPim vulnerable to remote code execution through Arbitrary File upload | high | 0.0 | 0% |
| CVE-2023-23937 | pimcore/pimcore | Pimcore contains Unrestricted Upload of File with Dangerous Type | medium | 5.4 | 0% |
| CVE-2026-38751 | devcode-it/openstamanager | OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality | high | 7.2 | 0% |
| CVE-2020-13241 | microweber/microweber | Microweber allows Unrestricted File Upload | high | 7.8 | 0% |
| CVE-2025-47658 | wsdesk (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpd | critical | 9.9 | 0% |
| CVE-2025-54677 | online-booking-\&-scheduling-calendar (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-s | critical | 9.1 | 0% |
| CVE-2023-6551 | verot/class.upload.php | class.upload.php allows cross-site scripting attacks via uploaded files | medium | 6.5 | 0% |
| CVE-2025-58048 | paymenter/paymenter | Paymenter vulnerable to Remote Code Execution via public file uploads | critical | 9.9 | 0% |
| CVE-2025-13827 | mautic/grapes-js-builder-bundle | GrapesJsBuilder File Upload allows all file uploads | high | 0.0 | 0% |