Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-45833 | easy-wp-smtp (WordPress plugin) | Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. | medium | 6.8 | 1% |
| CVE-2026-38993 | cockpit-hq/cockpit | Cockpit is vulnerable to directory traversal | medium | 6.5 | 1% |
| CVE-2026-42605 | azuracast/azuracast | AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload | high | 8.8 | 1% |
| CVE-2023-6160 | lifterlms (WordPress plugin) | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and includin | low | 3.3 | 1% |
| CVE-2025-4857 | newsletters-lite (WordPress plugin) | The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' para | high | 7.2 | 1% |
| CVE-2017-9067 | modx/revolution | MODX Revolution Directory Traversal Vulnerability | high | 7.0 | 1% |
| CVE-2024-1165 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id' | medium | 4.3 | 1% |
| CVE-2025-12493 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | critical | 9.8 | 1% |
| CVE-2023-6294 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with th | high | 7.2 | 1% |
| CVE-2024-5637 | market-exporter (WordPress plugin) | The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' | high | 7.5 | 1% |
| CVE-2025-1769 | product-import-export-for-woo (WordPress plugin) | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all | medium | 4.9 | 1% |
| CVE-2024-0380 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' att | medium | 5.4 | 1% |
| CVE-2023-6583 | import-and-export-users-and-customers (WordPress plugin) | The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1. | medium | 6.6 | 1% |
| CVE-2021-27916 | mautic/core | Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder | high | 8.1 | 1% |
| CVE-2023-29200 | contao/contao, contao/core-bundle | Path traversal vulnerability in the file manager | high | 8.8 | 1% |
| CVE-2023-30855 | pimcore/pimcore | Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php | medium | 6.5 | 1% |
| CVE-2022-25377 | appwrite/server-ce | Appwrite Directory Traversal vulnerability | high | 7.5 | 1% |
| CVE-2021-24242 | tutor-lms (WordPress plugin) | The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability throu | low | 3.8 | 1% |
| CVE-2024-5882 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticat | high | 7.5 | 1% |
| CVE-2026-75594 | getkirby/cms | Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling | high | 0.0 | 1% |
| CVE-2024-13920 | order-export-\&-order-import-for-woocommerce (WordPress plugin) | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi | medium | 4.9 | 1% |
| CVE-2024-0697 | backuply (WordPress plugin) | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and inclu | medium | 6.5 | 1% |
| CVE-2023-6947 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includin | high | 7.7 | 1% |
| CVE-2023-39528 | prestashop/prestashop | PrestaShop file access through path traversal | medium | 6.8 | 1% |
| CVE-2026-33513 | wwbn/avideo | AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) | high | 8.6 | 1% |
| CVE-2015-10030 | sukohi/surpass | SUKOHI Surpass Path Traversal vulnerability | medium | 5.3 | 1% |
| CVE-2024-10799 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventer_woo_downlo | medium | 6.5 | 1% |
| CVE-2025-1973 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 v | medium | 4.9 | 1% |
| CVE-2024-52292 | craftcms/cms | Craft CMS Arbitrary System File Read | high | 7.7 | 1% |
| CVE-2025-6379 | vidmov (WordPress plugin) | The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the | high | 8.8 | 1% |
| CVE-2019-7925 | magento/community-edition, magento/product-community-edition | Magento Insecure Direct Object Reference (IDOR) vulnerability | medium | 4.9 | 1% |
| CVE-2024-5481 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and i | medium | 6.8 | 1% |
| CVE-2026-41062 | wwbn/avideo | WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters | medium | 6.5 | 1% |
| CVE-2025-0365 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG | medium | 6.5 | 1% |
| CVE-2025-30159 | getkirby/kirby | Kirby vulnerable to path traversal of snippet names in the `snippet()` helper | medium | 0.0 | 1% |
| CVE-2023-5672 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to loc | medium | 6.5 | 1% |
| CVE-2026-33292 | wwbn/avideo | AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos | high | 7.5 | 1% |
| CVE-2026-34728 | phpmyfaq/phpmyfaq | phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController | high | 8.7 | 1% |
| CVE-2024-5852 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'up | medium | 4.3 | 1% |
| CVE-2023-0467 | wp-dark-mode (WordPress plugin) | The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP te | medium | 4.3 | 1% |
| CVE-2026-41202 | ci4-cms-erp/ci4ms | CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE | critical | 0.0 | 1% |
| CVE-2026-75592 | getkirby/cms | Kirby: Access to image files outside of the site root via path traversal in the media handling | medium | 0.0 | 1% |
| CVE-2025-0859 | post-and-page-builder (WordPress plugin) | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up | medium | 6.5 | 1% |
| CVE-2025-1785 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_ne | medium | 5.4 | 1% |
| CVE-2024-10585 | iwp-client (WordPress plugin) | The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' | medium | 5.3 | 1% |
| CVE-2024-13550 | abc-notation (WordPress plugin) | The ABC Notation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.3 via the 'file' attribute o | medium | 6.5 | 1% |
| CVE-2023-2336 | pimcore/pimcore | Path Traversal in Asset "import from server" option | medium | 6.5 | 1% |
| CVE-2024-13791 | bit-assist (WordPress plugin) | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() f | medium | 4.9 | 1% |
| CVE-2023-5355 | awesome-support (WordPress plugin) | The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket s | high | 8.1 | 1% |
| CVE-2024-0844 | popup-more (WordPress plugin) | The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via th | medium | 4.7 | 1% |