Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2249 | wpforo (WordPress plugin) | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions | high | 8.8 | 61% |
| CVE-2023-6989 | wp-simple-firewall (WordPress plugin) | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all v | critical | 9.8 | 57% |
| CVE-2025-4380 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions | high | 8.1 | 43% |
| CVE-2020-5295 | october/cms | Local File read vulnerability in OctoberCMS | medium | 4.8 | 7% |
| CVE-2023-3452 | canto (WordPress plugin) | The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter | critical | 9.8 | 7% |
| CVE-2024-3136 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template | critical | 9.8 | 5% |
| CVE-2023-5815 | blog-designer-pack (WordPress plugin) | The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post M | high | 8.1 | 5% |
| CVE-2024-10571 | chart-builder (WordPress plugin) | The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 | critical | 9.8 | 5% |
| CVE-2024-9193 | whmcs (WordPress plugin) | The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl | critical | 9.8 | 3% |
| CVE-2021-22968 | concrete5/core | Improper file handling in concrete5/core | high | 7.2 | 3% |
| CVE-2024-8252 | clean-login (WordPress plugin) | The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' a | high | 8.8 | 3% |
| CVE-2016-6565 | nextgen-gallery (WordPress plugin) | The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a | high | 7.5 | 3% |
| CVE-2015-10133 | subscribe-to-comments (WordPress plugin) | The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header | high | 7.2 | 2% |
| CVE-2026-44177 | getkirby/cms | Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup | high | 0.0 | 2% |
| CVE-2025-0366 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, | high | 8.8 | 2% |
| CVE-2024-2411 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' p | critical | 9.8 | 2% |
| CVE-2024-2047 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via | high | 8.8 | 1% |
| CVE-2026-34036 | dolibarr/dolibarr | Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php | medium | 6.5 | 1% |
| CVE-2023-5199 | php-to-page (WordPress plugin) | The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via t | critical | 9.9 | 1% |
| CVE-2024-10898 | cf7-email-add-on (WordPress plugin) | The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the | high | 8.8 | 1% |
| CVE-2025-54138 | librenms/librenms | LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE | high | 7.5 | 1% |
| CVE-2023-5250 | grid-plus (WordPress plugin) | The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.3 via a shortcode attribute. | high | 8.8 | 1% |
| CVE-2023-4488 | dropbox-folder-share (WordPress plugin) | The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php | critical | 9.8 | 1% |
| CVE-2024-10873 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4 | high | 8.8 | 1% |
| CVE-2024-3499 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via | high | 8.8 | 1% |
| CVE-2024-3500 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Men | high | 8.8 | 1% |
| CVE-2023-4195 | cockpit-hq/cockpit | Cockpit PHP Remote File Inclusion vulnerability | critical | 9.9 | 1% |
| CVE-2024-4936 | canto (WordPress plugin) | The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. | critical | 9.8 | 1% |
| CVE-2024-13592 | team-builder-for-wpbakery-page-builder (WordPress plugin) | The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versi | high | 7.5 | 1% |
| CVE-2015-5467 | yiisoft/yii2, yiisoft/yii2-dev | Yii2 allows attackers to execute any local .php file via a relative path in the view parameter | critical | 9.8 | 1% |
| CVE-2024-1382 | nd-restaurant-reservations (WordPress plugin) | The Restaurant Reservations plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the nd_ | high | 8.8 | 1% |
| CVE-2023-5099 | hk-filter-and-search (WordPress plugin) | The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the | high | 8.8 | 1% |
| CVE-2024-5503 | wp-blog-post-layouts (WordPress plugin) | The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes | high | 8.8 | 1% |
| CVE-2024-6589 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6 | high | 8.8 | 1% |
| CVE-2023-6583 | import-and-export-users-and-customers (WordPress plugin) | The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1. | medium | 6.6 | 1% |
| CVE-2025-7327 | business-reviews-wp (WordPress plugin) | The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the | high | 8.8 | 1% |
| CVE-2024-4258 | yotuwp-easy-youtube-embed (WordPress plugin) | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions u | critical | 9.8 | 1% |
| CVE-2024-3061 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, a | high | 7.2 | 1% |
| CVE-2026-33513 | wwbn/avideo | AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) | high | 8.6 | 1% |
| CVE-2025-22145 | nesbot/carbon | Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale | medium | 0.0 | 1% |
| CVE-2024-13353 | responsive-addons-for-elementor (WordPress plugin) | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Local File | high | 8.8 | 1% |
| CVE-2024-13593 | bmlt-meeting-map (WordPress plugin) | The BMLT Meeting Map plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.0 via the 'bmlt_me | high | 7.5 | 1% |
| CVE-2025-1771 | traveler (WordPress theme) | The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load | critical | 9.8 | 1% |
| CVE-2024-3813 | tagdiv-composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_t | high | 8.8 | 1% |
| CVE-2024-4551 | yotuwp-easy-youtube-embed (WordPress plugin) | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions u | medium | 6.4 | 1% |
| CVE-2024-4887 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the ' | high | 7.5 | 1% |
| CVE-2024-5455 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, | high | 8.8 | 1% |
| CVE-2024-3564 | custom-post-widget (WordPress plugin) | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3 | high | 8.8 | 1% |
| CVE-2025-0682 | addons (WordPress plugin) | The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_ | high | 8.8 | 1% |
| CVE-2025-4689 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to R | critical | 9.8 | 1% |