Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-25213 KEV | wp-file-manager (WordPress plugin) | Unauthenticated arbitrary file upload to RCE via the elFinder connector | critical | 10.0 | 97% |
| CVE-2020-35489 KEV | contact-form-7 (WordPress plugin) | Unrestricted file upload via unsanitised filenames (double extension) | critical | 10.0 | 89% |
| CVE-2020-13671 KEV | drupal/core, drupal/drupal | *Update November 18: Documented longer list of dangerous file extensions* Drupal core does not properly sanitize certai | high | 8.8 | 36% |
| CVE-2026-63030 KEV | WordPress core | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the | critical | 9.8 | 11% |
| CVE-2020-24186 | wpdiscuz (WordPress plugin) | A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated u | critical | 10.0 | 95% |
| CVE-2024-8856 | wp-time-capsule (WordPress plugin) | The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation i | critical | 9.8 | 94% |
| CVE-2022-1329 | elementor (WordPress plugin) | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capabili | high | 8.8 | 93% |
| CVE-2014-8739 | sexy-contact-form (WordPress plugin), blueimp/jquery-file-upload | Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Cre | critical | 9.8 | 92% |
| CVE-2021-24145 | modern-events-calendar-lite (WordPress plugin) | Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, | high | 7.2 | 87% |
| CVE-2023-5360 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthe | critical | 9.8 | 86% |
| CVE-2021-24155 | backup-guard (WordPress plugin) | The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP | high | 7.2 | 84% |
| CVE-2019-8942 | WordPress core | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an a | high | 8.8 | 83% |
| CVE-2021-42362 | wordpress-popular-posts (WordPress plugin) | The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in | high | 8.8 | 80% |
| CVE-2020-12800 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code ex | critical | 9.8 | 79% |
| CVE-2023-2034 | froxlor/froxlor | froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type | critical | 9.1 | 71% |
| CVE-2018-19422 | intelliants/subrion | Subrion CMS RCE Vulnerability | high | 7.2 | 65% |
| CVE-2017-1000119 | october/cms | October CMS PHP Code Execution | high | 7.2 | 61% |
| CVE-2021-24499 | workreap (WordPress plugin) | The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform non | critical | 9.8 | 60% |
| CVE-2021-39352 | catch-themes-demo-import (WordPress plugin) | The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchT | high | 7.2 | 56% |
| CVE-2021-25003 | wpcargo-track-\&-trace (WordPress plugin) | The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anyw | critical | 9.8 | 56% |
| CVE-2025-5961 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file | high | 7.2 | 55% |
| CVE-2023-6187 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro | high | 7.5 | 51% |
| CVE-2024-5084 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in | critical | 9.8 | 51% |
| CVE-2021-24370 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote cod | critical | 9.8 | 47% |
| CVE-2020-36847 | simple-file-list (WordPress plugin) | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename func | critical | 9.8 | 44% |
| CVE-2021-43421 | studio-42/elfinder | elFinder Unrestricted File Upload vulnerability | critical | 9.8 | 43% |
| CVE-2025-1128 | everest-forms (WordPress plugin) | The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbit | critical | 9.8 | 42% |
| CVE-2021-24284 | kaswara (WordPress plugin) | The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX actio | critical | 9.8 | 42% |
| CVE-2015-4455 | aviary-image-editor-add-on-for-gravity-forms (WordPress plugin) | Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPr | critical | 9.8 | 41% |
| CVE-2022-0888 | ninja-forms-file-uploads (WordPress plugin) | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type valida | critical | 9.8 | 39% |
| CVE-2022-4732 | microweber/microweber | Microweber vulnerable to unrestricted malicious uploads | high | 7.2 | 38% |
| CVE-2021-3120 | yith-woocommerce-gift-cards (WordPress plugin) | An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers | critical | 9.8 | 37% |
| CVE-2024-6220 | keydatas (WordPress plugin) | The 简数采集器 (Keydatas) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the keydatas_downlo | critical | 9.8 | 35% |
| CVE-2023-38874 | gugoan/economizzer | Economizzer remote code execution vulnerability | high | 8.8 | 32% |
| CVE-2024-6366 | profile-builder (WordPress plugin) | The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media | critical | 9.1 | 29% |
| CVE-2022-27115 | studio-42/elfinder | RCE in Studio-42 elFinder on Windows before 2.1.61 | critical | 9.8 | 29% |
| CVE-2020-14209 | dolibarr/dolibarr | Dolibarr Unrestricted Upload of File with Dangerous Type | high | 8.8 | 27% |
| CVE-2017-1002000 | mobile-friendly-app-builder-by-easytouch (WordPress plugin) | Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch | critical | 9.8 | 27% |
| CVE-2019-19576 | verot/class.upload.php | Remote code execution in verot/class.upload.php | critical | 9.8 | 26% |
| CVE-2022-1952 | easync (WordPress plugin) | The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation whic | critical | 9.8 | 25% |
| CVE-2022-0863 | wp-svg-icons (WordPress plugin) | The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like | high | 7.2 | 24% |
| CVE-2025-2005 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads fie | critical | 9.8 | 22% |
| CVE-2013-3684 | nextgen-gallery (WordPress plugin) | NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload | critical | 9.8 | 19% |
| CVE-2017-16949 | anonymous-post-pro (WordPress plugin) | An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization all | critical | 9.8 | 19% |
| CVE-2021-23394 | studio-42/elfinder | elFinder unsafe upload filtering leading to remote code execution | high | 8.1 | 19% |
| CVE-2025-1025 | cockpit-hq/cockpit | Cockpit Arbitrary File Upload | high | 7.5 | 19% |
| CVE-2022-38916 | pagekit/pagekit | Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type | critical | 9.8 | 18% |
| CVE-2024-7855 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() | high | 8.8 | 18% |
| CVE-2025-3914 | aeropage-sync-for-airtable (WordPress plugin) | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aero | high | 8.8 | 17% |
| CVE-2017-1002008 | membership-simplified-for-oap-members-only (WordPress plugin) | Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for | critical | 9.8 | 17% |