Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-9119 | db-backup (WordPress plugin) | Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbi | medium | 5.0 | 15% |
| CVE-2014-2674 | ajax-pagination (WordPress plugin) | Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary | high | 7.5 | 15% |
| CVE-2022-1391 | cab-fare-calculator (WordPress plugin) | The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, whic | critical | 9.8 | 15% |
| CVE-2019-6799 | phpmyadmin/phpmyadmin | phpMyAdmin Arbitrary file read vulnerability | medium | 5.9 | 15% |
| CVE-2024-21518 | opencart/opencart | Zip slip in opencart | high | 7.2 | 14% |
| CVE-2014-5465 | download-shortcode (WordPress plugin) | Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attac | medium | 5.0 | 14% |
| CVE-2015-4153 | zm-ajax-login-register (WordPress plugin) | Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and e | medium | 5.0 | 13% |
| CVE-2018-20463 | jsmol2wp (WordPress plugin) | An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal | high | 7.5 | 13% |
| CVE-2015-1365 | pixabay-images (WordPress plugin) | Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to wri | medium | 5.0 | 13% |
| CVE-2015-9480 | robotcpa (WordPress plugin) | The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter. | high | 7.5 | 13% |
| CVE-2017-14719 | WordPress core | Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip componen | high | 7.5 | 12% |
| CVE-2018-19040 | media-file-manager (WordPress plugin) | The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocat | medium | 5.3 | 12% |
| CVE-2016-10924 | ebook-download (WordPress plugin) | The ebook-download plugin before 1.2 for WordPress has directory traversal. | high | 7.5 | 12% |
| CVE-2014-9014 | wpmarketplace (WordPress plugin) | Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for Word | medium | 4.3 | 12% |
| CVE-2022-1392 | videos-sync-pdf (WordPress plugin) | The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could le | high | 7.5 | 11% |
| CVE-2015-4616 | easy2map (WordPress plugin) | Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers | medium | 5.0 | 10% |
| CVE-2022-4063 | inpost-gallery (WordPress plugin) | The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to | critical | 9.8 | 10% |
| CVE-2015-5469 | mdc-youtube-downloader (WordPress plugin) | Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary fil | high | 7.5 | 10% |
| CVE-2015-9538 | nextgen-gallery (WordPress plugin) | The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection. | medium | 6.5 | 10% |
| CVE-2018-19042 | media-file-manager (WordPress plugin) | The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to pa | medium | 5.3 | 10% |
| CVE-2018-19043 | media-file-manager (WordPress plugin) | The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory | medium | 5.3 | 10% |
| CVE-2019-16902 | arforms (WordPress plugin) | In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by s | high | 7.5 | 10% |
| CVE-2015-3301 | thecartpress (WordPress plugin) | Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for W | medium | 4.0 | 9% |
| CVE-2008-4769 | WordPress core | Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, al | high | 9.3 | 9% |
| CVE-2014-4937 | bookx (WordPress plugin) | Directory traversal vulnerability in includes/bookx_export.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary file | medium | 5.0 | 9% |
| CVE-2016-1000112 | contus-video-comments (WordPress plugin) | Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin | critical | 9.1 | 9% |
| CVE-2015-1000005 | candidate-application-form (WordPress plugin) | Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin | high | 7.5 | 9% |
| CVE-2020-10564 | wp-file-upload (WordPress plugin) | An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by up | critical | 9.8 | 9% |
| CVE-2019-10869 | ninja-forms-file-uploads (WordPress plugin) | Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activat | high | 8.1 | 8% |
| CVE-2006-5031 | cakephp/cakephp | CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files | medium | 0.0 | 8% |
| CVE-2015-7669 | easy2map (WordPress plugin) | Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin befo | critical | 9.8 | 7% |
| CVE-2017-14722 | WordPress core | Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename. | high | 7.5 | 7% |
| CVE-2020-12832 | simple-file-list (WordPress plugin) | WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the applicatio | critical | 9.8 | 7% |
| CVE-2022-24977 | impresscms/impresscms | Path Traversal in ImpressCMS | critical | 9.8 | 6% |
| CVE-2014-8606 | xcloner (WordPress plugin) | Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbit | medium | 4.0 | 6% |
| CVE-2023-6825 | wp-file-manager (WordPress plugin) | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7 | critical | 9.9 | 6% |
| CVE-2021-24644 | images-to-webp (WordPress plugin) | The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, | high | 7.5 | 6% |
| CVE-2022-41840 | welcart-e-commerce (WordPress plugin) | Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress. | high | 7.5 | 6% |
| CVE-2025-31131 | yeswiki/yeswiki | Yeswiki Path Traversal vulnerability allows arbitrary read of files | high | 8.6 | 6% |
| CVE-2006-3360 | phpsysinfo/phpsysinfo | phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence | medium | 0.0 | 6% |
| CVE-2019-11831 | drupal/core, drupal/drupal, typo3/phar-stream-wrapper | This security release fixes third-party dependencies included in or required by Drupal core. As described in [TYPO3-PSA- | critical | 9.8 | 5% |
| CVE-2015-4704 | download-zip-attachments (WordPress plugin) | Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files v | high | 7.5 | 5% |
| CVE-2021-25082 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statemen | high | 8.8 | 5% |
| CVE-2022-40734 | unisharp/laravel-filemanager | UniSharp Laravel Filemanager directory traversal vulnerability | medium | 6.5 | 5% |
| CVE-2021-24970 | all-in-one-video-gallery (WordPress plugin) | The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require sta | high | 7.2 | 5% |
| CVE-2015-7683 | font (WordPress plugin) | Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitra | medium | 4.0 | 5% |
| CVE-2021-24453 | include-me (WordPress plugin) | The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Executio | high | 8.8 | 5% |
| CVE-2019-14206 | adaptive-images (WordPress plugin) | An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete a | high | 7.5 | 5% |
| CVE-2014-5187 | tom-m8te-plugin (WordPress plugin) | Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via | medium | 5.0 | 5% |
| CVE-2019-14798 | photo-gallery (WordPress plugin) | The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/ad | medium | 4.9 | 4% |