Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2012-6652 | page-flip-book (WordPress plugin) | Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remot | critical | 9.8 | 4% |
| CVE-2021-3924 | getgrav/grav | Path traversal in grav | high | 8.8 | 4% |
| CVE-2019-1010257 | article2pdf (WordPress plugin) | An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, | critical | 9.1 | 4% |
| CVE-2019-6726 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fas | medium | 6.5 | 4% |
| CVE-2014-4941 | wp-cross-rss (WordPress plugin) | Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files v | medium | 5.0 | 4% |
| CVE-2014-5181 | lastfm-rotation-plugin (WordPress plugin) | Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attac | medium | 5.0 | 4% |
| CVE-2020-9689 | magento/community-edition, magento/project-community-edition | Magento path traversal vulnerability | medium | 6.5 | 4% |
| CVE-2015-9463 | s3bubble-amazon-s3-audio-streaming (WordPress plugin) | The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/down | high | 7.5 | 4% |
| CVE-2015-9470 | history-collection (WordPress plugin) | The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter. | high | 7.5 | 4% |
| CVE-2020-5237 | oneup/uploader-bundle | Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle | high | 8.8 | 4% |
| CVE-2015-1000006 | recent-backups (WordPress plugin) | Remote file download vulnerability in recent-backups v0.7 wordpress plugin | high | 7.5 | 4% |
| CVE-2008-0194 | WordPress core | Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete | high | 7.5 | 4% |
| CVE-2014-4577 | wp-amasin---the-amazon-affiliate-shop (WordPress plugin) | Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress all | medium | 5.0 | 4% |
| CVE-2015-9464 | s3bubble-amazon-s3-html-5-video-with-adverts (WordPress plugin) | The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/co | high | 7.5 | 4% |
| CVE-2019-14788 | newsletters-lite (WordPress plugin) | wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory t | high | 8.8 | 4% |
| CVE-2018-5287 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-abo | high | 7.5 | 4% |
| CVE-2018-5289 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-inf | high | 7.5 | 4% |
| CVE-2018-5290 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tra | high | 7.5 | 4% |
| CVE-2018-5291 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-too | high | 7.5 | 4% |
| CVE-2015-9473 | estrutura-basica (WordPress theme) | The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter. | high | 7.5 | 4% |
| CVE-2024-10763 | campress (WordPress theme) | The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocomme | critical | 9.8 | 4% |
| CVE-2014-1836 | impresscms/impresscms | ImpressCMS Path Traversal to Arbitrary File Delete | medium | 0.0 | 4% |
| CVE-2022-2711 | wp-all-import (WordPress plugin) | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, all | high | 7.2 | 4% |
| CVE-2018-13982 | smarty/smarty | Smarty Path Traversal Vulnerability | high | 7.5 | 3% |
| CVE-2008-0196 | WordPress core | Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot do | medium | 5.0 | 3% |
| CVE-2019-15822 | wps-child-theme-generator (WordPress plugin) | The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal. | critical | 9.8 | 3% |
| CVE-2017-11658 | wp-rocket (WordPress plugin) | In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, | high | 7.5 | 3% |
| CVE-2023-5991 | hotel-booking-lite (WordPress plugin) | The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper C | critical | 9.8 | 3% |
| CVE-2015-5472 | ibs-mappro (WordPress plugin) | Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read | high | 7.8 | 3% |
| CVE-2016-7169 | WordPress core | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade packa | medium | 6.3 | 3% |
| CVE-2021-26601 | impresscms/impresscms | Path Traversal in ImpressCMS | high | 8.1 | 3% |
| CVE-2012-6651 | vitamin (WordPress plugin) | Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary fil | medium | 5.0 | 3% |
| CVE-2014-10396 | epic (WordPress theme) | The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php. | high | 7.5 | 3% |
| CVE-2014-10397 | antioch (WordPress theme) | The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php. | high | 7.5 | 3% |
| CVE-2015-5609 | image-export (WordPress plugin) | Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary file | critical | 9.1 | 3% |
| CVE-2023-35169 | webklex/laravel-imap, webklex/php-imap | php-imap vulnerable to RCE through a directory traversal vulnerability | critical | 9.0 | 3% |
| CVE-2022-39261 | twig/twig, drupal/core | Twig may load a template outside a configured directory when using the filesystem loader | high | 7.5 | 3% |
| CVE-2012-3521 | geshi/geshi | GeSHi vulnerable to Directory Traversal | high | 0.0 | 3% |
| CVE-2020-3717 | magento/community-edition | Magento Path Traversal | medium | 5.3 | 3% |
| CVE-2020-36728 | adning-advertising (WordPress plugin) | The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This | medium | 6.5 | 3% |
| CVE-2021-36031 | magento/community-edition, magento/project-community-edition | Magento Path Traversal vulnerability via the `theme[preview_image]` parameter | high | 0.0 | 3% |
| CVE-2008-0615 | dmsguestbook (WordPress plugin) | Directory traversal vulnerability in wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allows remote authenticated | medium | 4.0 | 3% |
| CVE-2010-5099 | typo3/cms | TYPO3 Path Traversal vulnerability | medium | 0.0 | 3% |
| CVE-2021-24820 | cost-calculator (WordPress plugin) | The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) | medium | 6.5 | 3% |
| CVE-2024-34082 | getgrav/grav | Grav Vulnerable to Arbitrary File Read to Account Takeover | high | 8.5 | 3% |
| CVE-2015-10136 | gi-media-library (WordPress plugin) | The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allow | high | 7.5 | 3% |
| CVE-2023-1112 | drag-and-drop-multiple-file-upload---contact-form-7 (WordPress plugin) | A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Aff | medium | 4.7 | 3% |
| CVE-2018-9109 | studio-42/elfinder | elFinder Path Traversal vulnerability | critical | 9.1 | 3% |
| CVE-2020-29555 | getgrav/grav | Grav CMS Arbitrary File Deletion | high | 8.1 | 3% |
| CVE-2018-9110 | studio-42/elfinder | Directory Traversal in Studio 42 elFinder | critical | 9.1 | 3% |