Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5816 | code-explorer (WordPress plugin) | The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is | medium | 4.9 | 1% |
| CVE-2024-10672 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat | low | 2.7 | 0% |
| CVE-2026-59944 | composer/composer | Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path | medium | 6.1 | 0% |
| CVE-2023-6506 | wp-2fa (WordPress plugin) | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions | medium | 4.3 | 0% |
| CVE-2024-29800 | timber/timber | timber/timber vulnerable to Deserialization of Untrusted Data | high | 8.0 | 0% |
| CVE-2024-3668 | powerpack-addons-for-elementor (WordPress plugin) | The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. Th | high | 8.8 | 0% |
| CVE-2025-1911 | product-import-export-for-woo (WordPress plugin) | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion du | low | 2.7 | 0% |
| CVE-2025-3431 | zoomsounds (WordPress plugin) | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, | high | 7.5 | 0% |
| CVE-2025-1972 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valida | low | 2.7 | 0% |
| CVE-2024-13922 | order-export-\&-order-import-for-woocommerce (WordPress plugin) | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path | low | 2.7 | 0% |
| CVE-2021-24703 | download-plugin (WordPress plugin) | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowin | medium | 5.7 | 0% |
| CVE-2023-48714 | silverstripe/framework | Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter | medium | 4.3 | 0% |
| CVE-2024-12861 | w2s-migrate-woo-to-shopify (WordPress plugin) | The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2 | medium | 6.5 | 0% |
| CVE-2021-27908 | mautic/core | Mautic vulnerable to secret data exfiltration via symfony parameters | medium | 5.8 | 0% |
| CVE-2024-12267 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insuffi | medium | 5.3 | 0% |
| CVE-2026-45139 | ci4-cms-erp/ci4ms | CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations | medium | 6.5 | 0% |
| CVE-2023-6883 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple A | medium | 4.3 | 0% |
| CVE-2023-5651 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package | medium | 5.4 | 0% |
| CVE-2026-33354 | wwbn/avideo | AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php` | high | 7.6 | 0% |
| CVE-2026-49358 | pontedilana/php-weasyprint | PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles | low | 3.0 | 0% |
| CVE-2024-58383 | froxlor/froxlor | Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD> | high | 7.3 | 0% |
| CVE-2026-59946 | composer/composer | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files | medium | 6.1 | 0% |
| GHSA-97m3-52wr-xvv2 | phenx/php-svg-lib | Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE | critical | 10.0 | – |
| CVE-2026-45016 | egroupware/egroupware | EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose | medium | 6.5 | – |
| GHSA-2wwr-9x6f-88gp | easycorp/easyadmin-bundle | EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components | medium | 5.3 | – |