Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-4634 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and incl | critical | 9.8 | 86% |
| CVE-2018-1000207 | modx/revolution | MODX Revolution Incorrect Access Control vulnerability | high | 7.2 | 64% |
| CVE-2021-21809 | moodle/moodle | Moodle command execution vulnerability exists in the default legacy spellchecker plugin | critical | 9.1 | 24% |
| CVE-2025-6463 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to | high | 8.8 | 15% |
| CVE-2017-6104 | zen-mobile-app-native (WordPress plugin) | Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. | high | 7.5 | 7% |
| CVE-2023-30943 | moodle/moodle | Moodle External Control of File Name or Path vulnerability | medium | 5.3 | 7% |
| CVE-2021-24966 | error-log-viewer (WordPress plugin) | The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to cl | medium | 4.9 | 5% |
| CVE-2022-2431 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to i | high | 8.1 | 4% |
| CVE-2022-0246 | iq-block-country (WordPress plugin) | The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorize | medium | 4.9 | 3% |
| CVE-2021-38557 | billz/raspap-webgui | raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. | high | 8.8 | 2% |
| CVE-2017-16754 | bolt/bolt | Bolt Improper Access Control | medium | 5.3 | 2% |
| CVE-2021-41170 | neoan3-apps/template | Insecure Inherited Permissions in neoan3-apps/template | high | 7.5 | 2% |
| CVE-2025-4603 | store-manager-connector (WordPress plugin) | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path vali | critical | 9.1 | 2% |
| CVE-2021-32717 | shopware/core, shopware/platform | Private files publicly accessible with Cloud Storage providers | high | 7.5 | 1% |
| CVE-2022-1412 | log-wp-mail (WordPress plugin) | The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any u | high | 7.5 | 1% |
| CVE-2022-0593 | login-with-phone-number (WordPress plugin) | The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks | medium | 6.5 | 1% |
| CVE-2020-5296 | october/cms | Arbitrary File Deletion vulnerability in OctoberCMS | medium | 6.2 | 1% |
| CVE-2022-28056 | shopxo/shopxo | Incorrect Permission Assignment for Critical Resource in ShopXO | critical | 9.8 | 1% |
| CVE-2018-12642 | froxlor/froxlor | Froxlor Incorrect Access Control | high | 7.5 | 1% |
| CVE-2015-9456 | orbisius-child-theme-creator (WordPress plugin) | The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin | medium | 6.5 | 1% |
| CVE-2019-12245 | silverstripe/assets, silverstripe/framework | Lack of access control on upoaded files | medium | 5.3 | 1% |
| CVE-2018-1000025 | kreait/firebase-php | Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability | high | 8.1 | 1% |
| CVE-2018-1000165 | lightsaml/lightsaml | LightSAML Incorrect Access Control vulnerability | high | 7.5 | 1% |
| CVE-2022-2400 | dompdf/dompdf | Dompdf before v2.0.0 vulnerable to chroot check bypass | medium | 5.3 | 1% |
| CVE-2022-2638 | export-all-urls (WordPress plugin) | The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be t | medium | 6.5 | 1% |
| CVE-2020-5297 | october/cms | Upload whitelisted files to any directory in OctoberCMS | low | 3.4 | 1% |
| CVE-2022-39284 | codeigniter4/framework | Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued | low | 2.6 | 1% |
| CVE-2022-0277 | microweber/microweber | Microweber Incorrect Permission Assignment for Critical Resource vulnerability | medium | 6.5 | 1% |
| CVE-2026-30940 | baserproject/basercms | baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API | high | 7.2 | 1% |
| CVE-2022-24872 | shopware/core, shopware/platform | Improper Access Control in Shopware | high | 8.1 | 1% |
| CVE-2025-6691 | sureforms (WordPress plugin) | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f | high | 8.1 | 1% |
| CVE-2017-6928 | drupal/core, drupal/drupal | Drupal access bypass vulnerability | medium | 5.3 | 1% |
| CVE-2024-12875 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all | medium | 4.9 | 1% |
| CVE-2024-25117 | phenx/php-svg-lib | php-svg-lib lacks path validation on font through SVG inline styles | medium | 6.8 | 1% |
| CVE-2017-11422 | statamic/cms | Statamic framework Incorrect Permission Assignment | high | 8.8 | 1% |
| CVE-2019-19915 | 301-redirects (WordPress plugin) | The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, del | critical | 9.0 | 1% |
| CVE-2024-6467 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Rea | high | 8.8 | 1% |
| CVE-2026-84374 | maatwebsite/excel | Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path | high | 7.5 | 1% |
| CVE-2023-1070 | nilsteampassnet/teampass | TeamPass External Control of File Name or Path vulnerability | high | 7.1 | 1% |
| CVE-2021-4332 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2. | medium | 6.5 | 1% |
| CVE-2024-7626 | delicious-recipes (WordPress plugin) | The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movemen | high | 8.1 | 1% |
| CVE-2026-42845 | getgrav/grav-plugin-form | Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override | high | 0.0 | 1% |
| CVE-2025-4602 | store-manager-connector (WordPress plugin) | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, | medium | 5.9 | 1% |
| CVE-2025-3419 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versio | high | 7.5 | 1% |
| CVE-2024-37295 | aimeos/aimeos-core | Remote code execution in web server context | high | 7.2 | 1% |
| CVE-2026-9559 | mautic/core | Mautic vulnerable to Path Traversal via Campaign Import | critical | 9.9 | 1% |
| CVE-2022-42949 | silverstripe/subsites | SilverStripe Subsite weakens file permissions | medium | 5.4 | 1% |
| CVE-2025-64714 | privatebin/privatebin | PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal | medium | 5.8 | 1% |
| CVE-2025-49138 | elmsln/haxcms | HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter | medium | 6.5 | 1% |
| CVE-2024-12255 | accept-stripe-payments-using-contact-form-7 (WordPress plugin) | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |