Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-39316 | zoomsounds (WordPress plugin) | The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be dow | high | 7.5 | 66% |
| CVE-2023-6114 | duplicator (WordPress plugin) | The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-l | high | 7.5 | 31% |
| CVE-2023-33568 | dolibarr/dolibarr | Dolibarr vulnerable to unauthenticated database access | high | 7.5 | 15% |
| CVE-2021-43008 | vrana/adminer | Files or Directories Accessible to External Parties in Adminer | high | 7.5 | 14% |
| CVE-2022-41343 | dompdf/dompdf | Dompdf allows remote file inclusion because URI validation failure does not halt font registration | high | 7.5 | 6% |
| CVE-2022-33901 | multisafepay (WordPress plugin) | Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress. | medium | 5.3 | 3% |
| CVE-2023-6266 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the B | high | 7.5 | 2% |
| CVE-2017-6922 | drupal/core, drupal/drupal | Drupal core access bypass vulnerability | medium | 6.5 | 2% |
| CVE-2017-2551 | backwpup (WordPress plugin) | Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download. | high | 7.5 | 2% |
| CVE-2021-21355 | typo3/cms, typo3/cms-core, typo3/cms-form | Unrestricted File Upload in Form Framework | high | 8.6 | 2% |
| CVE-2022-2357 | wsm-downloader (WordPress plugin) | The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, in | high | 7.5 | 1% |
| CVE-2023-5199 | php-to-page (WordPress plugin) | The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via t | critical | 9.9 | 1% |
| CVE-2022-1585 | project-source-code-download (WordPress plugin) | The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which m | high | 7.5 | 1% |
| CVE-2022-35235 | wpide (WordPress plugin) | Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. | medium | 4.9 | 1% |
| CVE-2021-25004 | seur-oficial (WordPress plugin) | The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purp | medium | 4.9 | 1% |
| CVE-2022-2222 | download-monitor (WordPress plugin) | The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensiti | medium | 4.9 | 1% |
| CVE-2022-2392 | lana-downloads-manager (WordPress plugin) | The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by us | medium | 6.5 | 1% |
| CVE-2022-2981 | download-monitor (WordPress plugin) | The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensiti | medium | 4.9 | 1% |
| CVE-2019-14273 | silverstripe/framework | Broken access control on files | medium | 5.3 | 1% |
| CVE-2023-1124 | wp-easycart (WordPress plugin) | The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin p | high | 7.2 | 1% |
| CVE-2021-32752 | ether/logs | Files or Directories Accessible to External Parties in ether/logs | high | 7.2 | 1% |
| CVE-2021-24154 | theme-editor (WordPress plugin) | The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allo | medium | 4.9 | 1% |
| CVE-2022-29446 | counter-box (WordPress plugin) | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPr | medium | 6.8 | 1% |
| CVE-2022-29447 | hover-effects (WordPress plugin) | Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at W | medium | 6.8 | 1% |
| CVE-2023-3155 | nextgen-gallery (WordPress plugin) | The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter v | high | 7.2 | 1% |
| CVE-2024-4098 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_f | critical | 9.8 | 1% |
| CVE-2022-3691 | deepl-pro-api-translation (WordPress plugin) | The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files th | high | 7.5 | 1% |
| CVE-2022-2834 | helpful (WordPress plugin) | The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which | medium | 5.3 | 1% |
| CVE-2022-4106 | wholesale-market-for-woocommerce (WordPress plugin) | The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user inpu | high | 7.5 | 1% |
| CVE-2023-29931 | hhxsv5/laravel-s | laravel-s vulnerable to Local File Inclusion | critical | 9.8 | 1% |
| CVE-2022-31475 | give (WordPress plugin) | Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. | medium | 5.5 | 1% |
| CVE-2023-5099 | hk-filter-and-search (WordPress plugin) | The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the | high | 8.8 | 1% |
| CVE-2023-5907 | file-manager (WordPress plugin) | The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root out | medium | 6.5 | 1% |
| CVE-2024-51058 | tecnickcom/tcpdf | TCPDF Local File Inclusion vulnerability | medium | 6.2 | 1% |
| CVE-2022-44583 | watchtowerhq (WordPress plugin) | Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress. | high | 7.5 | 1% |
| CVE-2022-4236 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJA | medium | 6.5 | 1% |
| CVE-2022-44634 | import-shopify-to-woocommerce (WordPress plugin) | Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress. | medium | 4.9 | 1% |
| CVE-2024-52292 | craftcms/cms | Craft CMS Arbitrary System File Read | high | 7.7 | 1% |
| CVE-2023-4933 | wp-job-openings (WordPress plugin) | The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job | medium | 5.3 | 1% |
| CVE-2024-3564 | custom-post-widget (WordPress plugin) | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3 | high | 8.8 | 1% |
| CVE-2024-8031 | secure-downloads (WordPress plugin) | The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it pos | medium | 6.5 | 1% |
| CVE-2024-13126 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unaut | medium | 4.6 | 0% |
| CVE-2025-26525 | moodle/moodle | Moodle has an arbitrary file read risk through pdfTeX | high | 8.6 | 0% |
| CVE-2023-4930 | front-end-pm (WordPress plugin) | The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to privat | medium | 6.5 | 0% |
| GHSA-3pcr-4982-548m | shopware/production, shopware/shopware | Exposure of .env if project root is configured as web root in shopware/production | medium | 0.0 | – |