Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-10134 | simple-backup (WordPress plugin) | The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_b | high | 7.5 | 2% |
| CVE-2018-20714 | woocommerce (WordPress plugin) | The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allo | high | 8.1 | 2% |
| CVE-2021-24638 | omgf (WordPress plugin) | The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users | critical | 9.1 | 2% |
| CVE-2015-5482 | gd-bbpress-attachments (WordPress plugin) | Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and | medium | 4.0 | 2% |
| CVE-2021-28584 | magento/community-edition, magento/project-community-edition | Magento Path Traversal vulnerability | medium | 5.4 | 2% |
| CVE-2013-1939 | sabre/dav | SabreDAV Directory Traversal vulnerability | medium | 0.0 | 2% |
| CVE-2026-44177 | getkirby/cms | Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup | high | 0.0 | 2% |
| CVE-2022-34026 | icecoder/icecoder | ICEcoder vulnerable to Path Traversal | high | 7.5 | 2% |
| CVE-2021-27367 | bolt/core | Path traversal in bolt/core | high | 0.0 | 2% |
| CVE-2023-2688 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and includ | medium | 4.9 | 2% |
| CVE-2022-2945 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5 | medium | 4.9 | 2% |
| CVE-2022-1953 | product-configurator-for-woocommerce (WordPress plugin) | The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX ac | critical | 9.1 | 2% |
| CVE-2020-15246 | october/cms | Local File Inclusion by unauthenticated users | high | 7.5 | 2% |
| CVE-2022-2943 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including | medium | 4.9 | 2% |
| CVE-2012-1207 | forkcms/forkcms | ForkCMS Directory Traversal vulnerability | medium | 0.0 | 2% |
| CVE-2023-2278 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_ | critical | 9.8 | 2% |
| CVE-2011-2718 | phpmyadmin/phpmyadmin | phpMyAdmin Directory Traversal Vulnerability | medium | 0.0 | 2% |
| CVE-2020-24146 | cm-download-manager (WordPress plugin) | Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitr | high | 8.1 | 2% |
| CVE-2018-11495 | opencart/opencart | OpenCart Path Traversal | medium | 4.9 | 2% |
| CVE-2022-2557 | team---wordpress-team-members-showcase (WordPress plugin) | The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server | high | 8.8 | 2% |
| CVE-2021-41279 | baserproject/basercms | Potential Zip Slip Vulnerability in baserCMS | high | 7.7 | 2% |
| CVE-2021-21357 | typo3/cms, typo3/cms-core, typo3/cms-form | Broken Access Control in Form Framework | high | 8.3 | 2% |
| CVE-2018-5310 | media-from-ftp (WordPress plugin) | In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?p | medium | 6.5 | 2% |
| CVE-2021-24549 | aceide (WordPress plugin) | The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in | medium | 4.9 | 2% |
| CVE-2011-0986 | phpmyadmin/phpmyadmin | phpMyAdmin allows remote attackers to obtain installation path via direct request for nonexistent file | medium | 0.0 | 2% |
| CVE-2018-0586 | ultimate-member (WordPress plugin) | Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote au | medium | 4.3 | 2% |
| CVE-2023-4274 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. | high | 8.7 | 2% |
| CVE-2022-0665 | pimcore/pimcore | Path traversal in pimcore | medium | 6.5 | 2% |
| CVE-2020-36836 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 du | high | 8.0 | 1% |
| CVE-2021-44278 | librenms/librenms | Path traversal in librenms/librenms | critical | 9.8 | 1% |
| CVE-2022-2261 | wpide (WordPress plugin) | The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the ad | high | 7.2 | 1% |
| CVE-2025-7360 | ht-contactform (WordPress plugin) | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file | critical | 9.1 | 1% |
| CVE-2024-9224 | hello-world (WordPress plugin) | The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the hello_world | medium | 6.5 | 1% |
| CVE-2019-7859 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Path Traversal Vulnerability | high | 7.5 | 1% |
| CVE-2019-19848 | typo3/cms, typo3/cms-core | TYPO3 Directory Traversal on ZIP extraction | medium | 6.8 | 1% |
| CVE-2018-18576 | wordpress-popup (WordPress plugin) | The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/a | medium | 5.3 | 1% |
| CVE-2021-43676 | matyhtf/framework | Path manipulation in matyhtf/framework | critical | 9.8 | 1% |
| CVE-2017-1000490 | mautic/core | Mautic users able to download any files from server using filemanager | medium | 6.5 | 1% |
| CVE-2025-24406 | magento/community-edition, magento/project-community-edition | Adobe Commerce Path Traversal | high | 7.5 | 1% |
| CVE-2024-11150 | user-extra-fields (WordPress plugin) | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in th | critical | 9.8 | 1% |
| CVE-2022-0493 | string-locator (WordPress plugin) | The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege us | medium | 4.9 | 1% |
| CVE-2023-6972 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backu | critical | 9.8 | 1% |
| CVE-2021-24447 | wp-image-zoom (WordPress plugin) | The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to | medium | 5.3 | 1% |
| CVE-2026-55224 | mineadmin/mineadmin | MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall | high | 0.0 | 1% |
| CVE-2024-13725 | infusionsoft-official-opt-in-forms (WordPress plugin) | The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via th | critical | 9.8 | 1% |
| CVE-2021-24692 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web ser | medium | 6.5 | 1% |
| CVE-2024-52293 | craftcms/cms | Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI | high | 7.2 | 1% |
| CVE-2023-5414 | email-subscribers (WordPress plugin) | The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs | critical | 9.1 | 1% |
| CVE-2023-2252 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importin | low | 2.7 | 1% |
| CVE-2021-34638 | download-manager (WordPress plugin) | Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive conf | medium | 6.5 | 1% |