Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-11738 KEV | duplicator (WordPress plugin) | The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the f | high | 7.5 | 98% |
| CVE-2020-36193 KEV | pear/archive_tar | Directory Traversal in Archive_Tar | high | 7.5 | 71% |
| CVE-2024-9047 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_do | critical | 9.8 | 93% |
| CVE-2019-8943 | WordPress core | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output ima | medium | 6.5 | 92% |
| CVE-2023-2745 | WordPress core | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthen | medium | 5.4 | 79% |
| CVE-2021-39312 | seo-local-rank (WordPress plugin) | The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be a | high | 7.5 | 78% |
| CVE-2020-25540 | zoujingli/thinkadmin | ThinkAdmin directory traversal vulnerability | high | 7.5 | 75% |
| CVE-2021-32682 | studio-42/elfinder | elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE | critical | 9.8 | 70% |
| CVE-2014-8799 | dukapress (WordPress plugin) | Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress a | medium | 5.0 | 68% |
| CVE-2021-39316 | zoomsounds (WordPress plugin) | The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be dow | high | 7.5 | 66% |
| CVE-2019-14205 | adaptive-images (WordPress plugin) | A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arb | high | 7.5 | 63% |
| CVE-2018-16283 | wechat-brodcast (WordPress plugin) | The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter. | critical | 9.8 | 63% |
| CVE-2018-7422 | site-editor (WordPress plugin) | A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary fil | high | 7.5 | 62% |
| CVE-2018-12895 | WordPress core | WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb param | high | 8.8 | 62% |
| CVE-2024-27921 | getgrav/grav | Grav File Upload Path Traversal | high | 8.8 | 61% |
| CVE-2023-6989 | wp-simple-firewall (WordPress plugin) | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all v | critical | 9.8 | 57% |
| CVE-2025-1661 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, a | critical | 9.8 | 56% |
| CVE-2015-9406 | mtheme-unus (WordPress theme) | Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot | high | 7.5 | 55% |
| CVE-2022-26960 | studio-42/elfinder | Path Traversal in Studio-42 elFinder through 2.1.60 | critical | 9.1 | 51% |
| CVE-2023-6623 | essential-blocks (WordPress plugin) | The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when renderin | critical | 9.8 | 51% |
| CVE-2022-0679 | narnoo-distributor (WordPress plugin) | The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call | critical | 9.8 | 48% |
| CVE-2018-9118 | wp-background-takeover-advertisements (WordPress plugin) | exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a | high | 7.5 | 46% |
| CVE-2022-1476 | all-in-one-wp-migration (WordPress plugin) | The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file v | medium | 6.6 | 46% |
| CVE-2019-13635 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal. | critical | 9.1 | 44% |
| CVE-2018-16299 | localize-my-post (WordPress plugin) | The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. | high | 7.5 | 44% |
| CVE-2019-9618 | gracemedia-media-player (WordPress plugin) | The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter. | critical | 9.8 | 44% |
| CVE-2015-2067 | dweeves/magmi | MAGMI plugin for Magento Server Directory Traversal | medium | 0.0 | 38% |
| CVE-2016-6896 | WordPress core | Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remo | high | 7.1 | 38% |
| CVE-2024-10470 | wordpress-learning-management-system (WordPress theme) | The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due | critical | 9.8 | 35% |
| CVE-2015-5471 | swim-team (WordPress plugin) | Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers | medium | 5.3 | 32% |
| CVE-2020-35749 | simple-board-job (WordPress plugin) | Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for | high | 7.7 | 30% |
| CVE-2022-47945 | topthink/framework | ThinkPHP Framework vulnerable to remote code execution | critical | 9.8 | 30% |
| CVE-2023-52085 | winter/wn-backend-module | Winter CMS Local File Inclusion through Server Side Template Injection | low | 3.3 | 30% |
| CVE-2022-2863 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content | medium | 4.9 | 25% |
| CVE-2015-5468 | wp-ecommerce-shop-styling (WordPress plugin) | Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrar | high | 7.5 | 24% |
| CVE-2017-17058 | woocommerce (WordPress plugin) | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/ema | high | 7.5 | 24% |
| CVE-2022-1390 | admin-word-count-column (WordPress plugin) | The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthe | critical | 9.8 | 22% |
| CVE-2015-1579 | divi (WordPress theme) | Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (d | medium | 5.0 | 21% |
| CVE-2014-9734 | patch-for-revolution-slider (WordPress plugin) | Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbit | medium | 5.0 | 20% |
| CVE-2022-1119 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloade | high | 7.5 | 20% |
| CVE-2023-0156 | all-in-one-security (WordPress plugin) | The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an au | medium | 4.9 | 20% |
| CVE-2014-4940 | tera-charts (WordPress plugin) | Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary | medium | 5.0 | 19% |
| CVE-2015-4414 | se-html5-album-audio-player (WordPress plugin) | Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and ea | medium | 5.0 | 19% |
| CVE-2014-5368 | wp-content-source-control (WordPress plugin) | Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-sourc | medium | 5.0 | 19% |
| CVE-2014-8801 | paid-memberships-pro (WordPress plugin) | Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attac | medium | 5.0 | 18% |
| CVE-2020-28337 | microweber/microweber | Zip slip in Microweber | high | 7.2 | 17% |
| CVE-2015-5065 | paypal-currency-converter-basic-for-woocommerce (WordPress plugin) | Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plug | medium | 5.0 | 16% |
| CVE-2024-55415 | tcg/voyager | DevDojo Voyager vulnerable to path traversal | high | 0.0 | 16% |
| CVE-2015-4694 | zip-attachments (WordPress plugin) | Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read a | high | 8.6 | 16% |
| CVE-2017-15363 | aoe/restler, luracast/restler | Luracast Restler directory traversal vulnerability | high | 7.5 | 15% |