Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-4703 | rename (WordPress plugin) | Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to | medium | 5.3 | 3% |
| CVE-2021-24962 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path travers | high | 8.8 | 3% |
| CVE-2019-25213 | advanced-access-manager (WordPress plugin) | The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9. | critical | 9.8 | 3% |
| CVE-2017-10993 | contao/contao, contao/core, contao/core-bundle | Contao Core directory traversal vulnerability | high | 8.8 | 3% |
| CVE-2017-16654 | symfony/intl, symfony/symfony | Symfony Directory Traversal | high | 7.5 | 3% |
| CVE-2022-3361 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient inp | medium | 4.3 | 3% |
| CVE-2018-16831 | smarty/smarty | Smarty Path Traversal Vulnerability | medium | 5.9 | 3% |
| CVE-2021-24375 | motor (WordPress plugin) | Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handler | critical | 9.8 | 3% |
| CVE-2016-10966 | real3d-flipbook-lite (WordPress plugin) | The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload. | high | 7.5 | 3% |
| CVE-2015-1493 | moodle/moodle | Moodle directory traversal vulnerability | medium | 0.0 | 3% |
| CVE-2020-12479 | nilsteampassnet/teampass | TeamPass PHP arbitrary file include vulnerability | high | 8.8 | 3% |
| CVE-2023-5241 | chatbot (WordPress plugin) | The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_open | critical | 9.6 | 3% |
| CVE-2017-15079 | wp-smushit (WordPress plugin) | The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. | high | 7.5 | 3% |
| CVE-2018-0588 | ultimate-member (WordPress plugin) | Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attacker | high | 7.5 | 3% |
| CVE-2014-10390 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal. | critical | 9.1 | 3% |
| CVE-2017-18586 | insert-pages (WordPress plugin) | The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths. | critical | 9.1 | 3% |
| CVE-2025-14675 | wpmetabox/meta-box | Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file | high | 7.2 | 2% |
| CVE-2006-0931 | pear/archive_tar | PEAR::Archive_Tar Directory Traversal vulnerability | critical | 9.1 | 2% |
| CVE-2019-15839 | sina-extension-for-elementor (WordPress plugin) | The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. | high | 7.5 | 2% |
| CVE-2022-0779 | user-meta-user-profile-builder-and-user-management (WordPress plugin) | The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could a | medium | 6.5 | 2% |
| CVE-2018-11494 | opencart/opencart | OpenCart Path Traversal | high | 8.0 | 2% |
| CVE-2019-15326 | import-users-from-csv-with-meta (WordPress plugin) | The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal. | high | 7.5 | 2% |
| CVE-2022-1560 | amministrazione-aperta (WordPress plugin) | The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading | medium | 6.5 | 2% |
| CVE-2022-34254 | magento/community-edition | Magento Path Traversal vulnerability | high | 8.5 | 2% |
| CVE-2021-38360 | wp-publications (WordPress plugin) | The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser | high | 8.3 | 2% |
| CVE-2017-16759 | librenms/librenms | LibreNMS Arbitrary File Read | medium | 5.9 | 2% |
| CVE-2025-34076 | microweber/microweber | Microweber CMS API has authenticated local file inclusion vulnerability | medium | 0.0 | 2% |
| CVE-2016-10965 | real3d-flipbook-lite (WordPress plugin) | The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion. | high | 7.5 | 2% |
| CVE-2016-10977 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal. | medium | 6.5 | 2% |
| CVE-2019-12464 | librenms/librenms | Path Traversal in LibreNMS | high | 7.5 | 2% |
| CVE-2015-4617 | easy2map-photos (WordPress plugin) | Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying f | high | 7.5 | 2% |
| CVE-2022-30117 | concrete5/core | Path traversal in Concrete CMS | critical | 9.1 | 2% |
| CVE-2015-0269 | contao/core | Contao Core directory traversal vulnerability | medium | 4.3 | 2% |
| CVE-2022-23793 | joomla/archive | Path Traversal within joomla/archive tar class | high | 7.5 | 2% |
| CVE-2014-9461 | cart66-lite (WordPress plugin) | Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated user | low | 3.5 | 2% |
| CVE-2020-5590 | ec-cube/ec-cube | EC-CUBE Directory traversal vulnerability | high | 8.1 | 2% |
| CVE-2021-43836 | sulu/sulu | PHP file inclusion in the Sulu admin panel | high | 8.5 | 2% |
| CVE-2024-10708 | system-dashboard (WordPress plugin) | The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such | medium | 4.9 | 2% |
| CVE-2018-7586 | nextgen-gallery (WordPress plugin) | In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured. | high | 7.5 | 2% |
| CVE-2019-15323 | ad-inserter (WordPress plugin) | The ad-inserter plugin before 2.4.20 for WordPress has path traversal. | high | 7.5 | 2% |
| CVE-2020-24144 | media-file-organizer (WordPress plugin) | Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files t | high | 8.6 | 2% |
| CVE-2022-0320 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include | critical | 9.8 | 2% |
| CVE-2023-5212 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9. | critical | 9.6 | 2% |
| CVE-2017-18585 | posts-in-page (WordPress plugin) | The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal. | high | 8.1 | 2% |
| CVE-2020-24143 | video-downloader-for-tiktok (WordPress plugin) | Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files | high | 7.5 | 2% |
| CVE-2022-39296 | melisplatform/melis-asset-manager | melisplatform/melis-asset-manager vulnerable to Path Traversal | high | 7.5 | 2% |
| CVE-2023-35840 | studio-42/elfinder | elFinder vulnerable to path traversal in LocalVolumeDriver connector | high | 7.5 | 2% |
| CVE-2011-2508 | phpmyadmin/phpmyadmin | phpMyAdmin Directory Traversal vulnerability | high | 0.0 | 2% |
| CVE-2010-5101 | typo3/cms | TYPO3 Directory Traversal vulnerability | medium | 0.0 | 2% |
| CVE-2021-24363 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside | medium | 4.9 | 2% |