Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-45140 | chamilo/chamilo-lms | Chamilo LMS CStudio upload flow allows unauthenticated remote code execution | critical | 9.8 | 1% |
| CVE-2021-24689 | contact-form (WordPress plugin) | The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files | medium | 4.9 | 1% |
| CVE-2021-24566 | fox---currency-switcher-professional-for-woocommerce (WordPress plugin) | The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode. | high | 8.8 | 1% |
| CVE-2021-23340 | pimcore/pimcore | Path traversal in pimcore/pimcore | high | 7.1 | 1% |
| CVE-2023-6559 | mw-wp-form (WordPress plugin) | The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the | high | 7.5 | 1% |
| CVE-2024-0221 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, | critical | 9.1 | 1% |
| CVE-2021-41143 | openmage/magento-lts | Fix for arbitrary file deletion in customer media allows for remote code execution | high | 7.2 | 1% |
| CVE-2024-13545 | ultimate-bootstrap-elements-for-elementor (WordPress theme) | The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path pa | critical | 9.8 | 1% |
| CVE-2024-52291 | craftcms/cms | Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution | high | 8.4 | 1% |
| CVE-2024-4442 | salon-booking-system (WordPress plugin) | The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is du | critical | 9.1 | 1% |
| CVE-2024-1358 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the | high | 8.8 | 1% |
| CVE-2023-3813 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it pos | high | 7.5 | 1% |
| CVE-2024-1974 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, | high | 8.8 | 1% |
| CVE-2023-43648 | baserproject/basercms | baserCMS Directory Traversal vulnerability in Form submission data management Feature | medium | 4.9 | 1% |
| CVE-2023-3172 | froxlor/froxlor | Froxlor vulnerable to Path Traversal | high | 7.2 | 1% |
| CVE-2024-7950 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusio | critical | 9.8 | 1% |
| CVE-2022-40199 | ec-cube/ec-cube | EC-CUBE Directory traversal vulnerability | low | 2.7 | 1% |
| CVE-2019-11590 | form-maker (WordPress plugin) | The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local f | high | 8.8 | 1% |
| CVE-2023-30451 | typo3/cms-core | Path Traversal in TYPO3 File Abstraction Layer Storages | medium | 5.5 | 1% |
| CVE-2022-35235 | wpide (WordPress plugin) | Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. | medium | 4.9 | 1% |
| CVE-2024-10011 | buddypress (WordPress plugin) | The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. | high | 8.1 | 1% |
| CVE-2022-42188 | lavalite/cms | Lavalite vulnerable to Arbitrary File Read via Directory Traversal | high | 7.5 | 1% |
| CVE-2025-1282 | car-dealer-automotive (WordPress theme) | The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file | high | 8.8 | 1% |
| CVE-2023-2435 | blog-in-blog (WordPress plugin) | The Blog-in-Blog plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.0 via a shortcode attribut | high | 7.2 | 1% |
| CVE-2023-1478 | hummingbird (WordPress plugin) | The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to | critical | 9.8 | 1% |
| CVE-2025-50706 | topthink/framework | ThinkPHP Path Traversal Vulnerability | critical | 0.0 | 1% |
| CVE-2025-2328 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient | high | 8.8 | 1% |
| CVE-2024-6164 | filter-\&-grids (WordPress plugin) | The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possibl | critical | 9.8 | 1% |
| CVE-2024-11642 | ajax-filter-posts (WordPress plugin) | The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builde | critical | 9.8 | 1% |
| CVE-2024-6312 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af | medium | 6.5 | 1% |
| CVE-2026-30940 | baserproject/basercms | baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API | high | 7.2 | 1% |
| CVE-2023-6222 | quttera-web-malware-scanner (WordPress plugin) | IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with a | high | 7.2 | 1% |
| CVE-2019-11557 | contact-form-builder (WordPress plugin) | The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with res | high | 8.8 | 1% |
| CVE-2019-11591 | contact-form-maker (WordPress plugin) | The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant l | high | 8.8 | 1% |
| CVE-2021-25020 | complete-analytics-optimization-suite (WordPress plugin) | The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privileg | medium | 4.9 | 1% |
| CVE-2021-25021 | optimize-my-google-fonts (WordPress plugin) | The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege u | medium | 4.9 | 1% |
| CVE-2023-5105 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download lo | medium | 6.5 | 1% |
| CVE-2025-0493 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclu | critical | 9.8 | 1% |
| CVE-2023-49508 | yetiforce/yetiforce-crm | YetiForceCRM Directory Traversal vulnerability | medium | 6.5 | 1% |
| CVE-2023-2315 | opencart/opencart | OpenCart Path Traversal vulnerability | high | 8.1 | 1% |
| CVE-2025-3294 | wp-editor (WordPress plugin) | The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and inc | high | 7.2 | 1% |
| CVE-2020-7790 | spatie/browsershot | browsershot local file inclusion vulnerability | medium | 5.3 | 1% |
| CVE-2024-9939 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_do | high | 7.5 | 1% |
| CVE-2025-13645 | modula-best-grid-gallery (WordPress plugin) | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax | high | 7.2 | 1% |
| CVE-2026-49970 | plank/laravel-mediable | Laravel-Mediable: path traversal vulnerability in the File::sanitizePath() | high | 8.8 | 1% |
| CVE-2024-10625 | woocommerce-support-ticket-system (WordPress plugin) | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation | critical | 9.8 | 1% |
| CVE-2024-7777 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | critical | 9.0 | 1% |
| CVE-2024-7149 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versi | high | 8.8 | 1% |
| CVE-2024-5709 | page-builder (WordPress plugin) | The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'l | high | 8.8 | 1% |
| CVE-2022-1850 | filegator/filegator | Path Traversal in FileGator | medium | 5.4 | 1% |