Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-26028 | joomla/archive | Path Traversal within joomla/archive zip class | medium | 0.0 | 1% |
| CVE-2024-4098 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_f | critical | 9.8 | 1% |
| CVE-2024-8671 | wooevents (WordPress plugin) | The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path vali | critical | 9.1 | 1% |
| CVE-2024-5147 | wpzoom-elementor-addons (WordPress plugin) | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and i | critical | 9.8 | 1% |
| CVE-2024-5153 | startklar-elmentor-forms-extwidgets (WordPress plugin) | The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via th | critical | 9.1 | 1% |
| CVE-2023-30852 | pimcore/pimcore | Arbitrary File Read in Admin JS CSS files | medium | 4.4 | 1% |
| CVE-2024-12875 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all | medium | 4.9 | 1% |
| CVE-2020-29556 | getgrav/grav | Grav CMS Local File Injection | medium | 5.5 | 1% |
| CVE-2023-5505 | backwpup (WordPress plugin) | The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup f | medium | 6.8 | 1% |
| CVE-2025-7694 | woffice (WordPress plugin) | The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_ | medium | 6.8 | 1% |
| CVE-2024-9669 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, | high | 7.2 | 1% |
| CVE-2026-27823 | egroupware/egroupware | EGroupware has a Remote Code Execution Vulnerability | critical | 0.0 | 1% |
| CVE-2022-2554 | enable-media-replace (WordPress plugin) | The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow | medium | 4.9 | 1% |
| CVE-2024-8352 | social-web-suite (WordPress plugin) | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all ve | high | 7.5 | 1% |
| CVE-2015-10105 | ip-blacklist-cloud (WordPress plugin) | A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function | medium | 6.3 | 1% |
| CVE-2025-4828 | support-board (WordPress plugin) | The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_dele | critical | 9.8 | 1% |
| CVE-2024-8104 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includ | high | 8.8 | 1% |
| CVE-2024-5349 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3 | high | 8.8 | 1% |
| CVE-2025-65346 | alexusmai/laravel-file-manager | alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality | critical | 9.1 | 1% |
| CVE-2022-41951 | oro/platform | OroPlatform vulnerable to path traversal during temporary file manipulations | high | 8.5 | 1% |
| CVE-2024-21547 | spatie/browsershot | Spatie Browsershot Directory Traversal vulnerability | high | 7.5 | 1% |
| CVE-2025-57811 | craftcms/cms | Craft CMS Potential Remote Code Execution via Twig SSTI | medium | 0.0 | 1% |
| CVE-2005-10002 | secure-files (WordPress plugin) | A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the | medium | 5.5 | 1% |
| CVE-2024-5179 | cowidgets-elementor-addons (WordPress plugin) | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via | high | 8.8 | 1% |
| CVE-2024-10626 | woocommerce-support-ticket-system (WordPress plugin) | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation | high | 8.8 | 1% |
| CVE-2025-61923 | prestashop/ps_checkout | PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure | medium | 4.1 | 1% |
| CVE-2023-5504 | backwpup (WordPress plugin) | The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This | high | 8.7 | 1% |
| CVE-2024-7782 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | high | 8.7 | 1% |
| CVE-2021-24639 | omgf (WordPress plugin) | The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX actio | high | 8.1 | 1% |
| CVE-2024-39399 | magento/community-edition, magento/project-community-edition | Magento Path Traversal vulnerability | high | 7.7 | 1% |
| CVE-2024-2654 | wp-file-manager (WordPress plugin) | The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_b | medium | 6.8 | 1% |
| CVE-2024-7145 | jetelements (WordPress plugin) | The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_ty | high | 8.8 | 1% |
| CVE-2025-55988 | dreamfactory/df-core | DreamFactory has a directory traversal | high | 7.2 | 1% |
| CVE-2024-2385 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.4 via se | high | 8.8 | 1% |
| CVE-2023-4914 | cecil/cecil | Cecil Path Traversal vulnerability | high | 7.5 | 1% |
| CVE-2015-5467 | yiisoft/yii2, yiisoft/yii2-dev | Yii2 allows attackers to execute any local .php file via a relative path in the view parameter | critical | 9.8 | 1% |
| CVE-2024-8704 | file-manager-advanced (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 | high | 7.2 | 1% |
| CVE-2022-31475 | give (WordPress plugin) | Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. | medium | 5.5 | 1% |
| CVE-2024-22723 | fisharebest/webtrees | Webtrees Path Traversal vulnerability | medium | 4.9 | 1% |
| CVE-2025-1770 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versi | high | 8.8 | 1% |
| CVE-2024-39406 | magento/community-edition | Magento Open Source Path Traversal vulnerability | medium | 6.8 | 1% |
| CVE-2024-46212 | redaxo/source | Path traversal in redaxo | medium | 4.9 | 1% |
| CVE-2023-6026 | elijaa/phpmemcacheadmin | PHPMemcachedAdmin Path Traversal vulnerability | critical | 9.8 | 1% |
| CVE-2025-6755 | game-users-share-buttons (WordPress plugin) | The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the a | high | 8.8 | 1% |
| CVE-2023-39525 | prestashop/prestashop | PrestaShop path traversal | medium | 6.5 | 1% |
| CVE-2024-45291 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled | medium | 6.3 | 1% |
| CVE-2023-6699 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includin | critical | 9.1 | 1% |
| CVE-2024-13409 | post-grid-carousel-ultimate (WordPress plugin) | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local F | high | 7.5 | 1% |
| CVE-2023-27577 | flarum/core | Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files | medium | 6.5 | 1% |
| CVE-2026-84374 | maatwebsite/excel | Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path | high | 7.5 | 1% |