Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6825 | wp-file-manager (WordPress plugin) | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7 | critical | 9.9 | 6% |
| CVE-2020-5237 | oneup/uploader-bundle | Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle | high | 8.8 | 4% |
| CVE-2023-1112 | drag-and-drop-multiple-file-upload---contact-form-7 (WordPress plugin) | A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Aff | medium | 4.7 | 3% |
| CVE-2024-47051 | mautic/core | Mautic allows Remote Code Execution and File Deletion in Asset Uploads | critical | 9.1 | 2% |
| CVE-2024-10508 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation v | critical | 9.8 | 2% |
| CVE-2025-46002 | simogeo/filemanager | Filemanager is vulnerable to Relative Path Traversal through filemanager.php | medium | 6.5 | 1% |
| CVE-2023-4914 | cecil/cecil | Cecil Path Traversal vulnerability | high | 7.5 | 1% |
| CVE-2021-27916 | mautic/core | Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder | high | 8.1 | 1% |
| CVE-2026-8134 | concrete5/concrete5 | Concrete CMS Vulnerable to Relative Path Traversal | high | 7.2 | 1% |
| CVE-2025-30159 | getkirby/kirby | Kirby vulnerable to path traversal of snippet names in the `snippet()` helper | medium | 0.0 | 1% |
| CVE-2024-11024 | apppresser (WordPress plugin) | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, | critical | 9.8 | 1% |
| CVE-2024-13791 | bit-assist (WordPress plugin) | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() f | medium | 4.9 | 1% |
| CVE-2025-0822 | bit-assist (WordPress plugin) | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This m | medium | 6.5 | 1% |
| CVE-2025-44163 | billz/raspap-webgui | raspap-webgui has a Directory Traversal vulnerability | high | 0.0 | 1% |
| CVE-2025-31493 | getkirby/cms | Kirby vulnerable to path traversal of collection names during file system lookup | medium | 0.0 | 1% |
| CVE-2025-30207 | getkirby/cms | Kirby vulnerable to path traversal in the router for PHP's built-in server | low | 0.0 | 1% |
| CVE-2024-25979 | moodle/moodle | Improper Handling of Parameters in moodle | medium | 5.3 | 1% |
| CVE-2025-2056 | hide-my-wp (WordPress plugin) | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and includ | high | 7.5 | 1% |
| CVE-2025-64714 | privatebin/privatebin | PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal | medium | 5.8 | 1% |
| CVE-2026-55474 | snipe/snipe-it | Snipe-IT vulnerable to directory traversal in displaySig | high | 0.0 | 0% |