Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-1000150 | simplified-content (WordPress plugin) | Reflected XSS in wordpress plugin simplified-content v1.0.0 | medium | 6.1 | 2% |
| CVE-2016-1000151 | tera-charts (WordPress plugin) | Reflected XSS in wordpress plugin tera-charts v1.0 | medium | 6.1 | 2% |
| CVE-2022-1221 | gwyn\'s-imagemap-selector (WordPress plugin) | The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attr | medium | 6.1 | 2% |
| CVE-2018-6905 | typo3/cms | Typo3 XSS Vulnerability | medium | 4.8 | 2% |
| CVE-2020-18324 | intelliants/subrion | Cross-site Scripting in Subrion CMS | medium | 6.1 | 2% |
| CVE-2018-11366 | loginizer (WordPress plugin) | init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is | medium | 6.1 | 2% |
| CVE-2020-15159 | baserproject/basercms | Cross Site Scripting and RCE in baserCMS | high | 7.6 | 2% |
| CVE-2017-1000033 | vospari-forms (WordPress plugin) | Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascrip | medium | 6.1 | 2% |
| CVE-2021-25099 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an | medium | 6.1 | 2% |
| CVE-2008-2068 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vec | medium | 4.3 | 2% |
| CVE-2015-7320 | appointment-booking-calendar (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calenda | medium | 4.3 | 2% |
| CVE-2020-11029 | WordPress core | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site | medium | 5.8 | 2% |
| CVE-2011-4634 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2020-4046 | WordPress core | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inj | medium | 5.4 | 2% |
| CVE-2014-5196 | improved-user-search-in-backend (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend | medium | 4.3 | 2% |
| CVE-2016-5834 | WordPress core | Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 a | medium | 6.1 | 2% |
| CVE-2017-14718 | WordPress core | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. | medium | 6.1 | 2% |
| CVE-2017-14721 | WordPress core | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. | medium | 6.1 | 2% |
| CVE-2013-2201 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML | medium | 4.3 | 2% |
| CVE-2009-3891 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject ar | low | 3.5 | 2% |
| CVE-2015-8353 | role-scoper (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary w | medium | 6.1 | 2% |
| CVE-2015-8354 | ultimate-member (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inje | medium | 6.1 | 2% |
| CVE-2020-11026 | WordPress core | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon | high | 8.7 | 2% |
| CVE-2021-24814 | wordpress-gdpr\&ccpa (WordPress plugin) | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authentic | critical | 9.6 | 2% |
| CVE-2017-14720 | WordPress core | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. | medium | 6.1 | 2% |
| CVE-2018-14631 | moodle/moodle | Moodle Cross-site Scripting | medium | 6.1 | 2% |
| CVE-2021-25063 | contact-form-7-skins (WordPress plugin) | The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an ad | medium | 6.1 | 2% |
| CVE-2024-4180 | the-events-calendar (WordPress plugin) | The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX. | critical | 9.1 | 2% |
| CVE-2020-4041 | bolt/bolt | The filename of uploaded files vulnerable to stored XSS | high | 7.4 | 2% |
| CVE-2015-7668 | easy2map (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote att | medium | 6.1 | 2% |
| CVE-2015-1879 | google-document-embedder (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arb | medium | 4.3 | 2% |
| CVE-2014-2333 | lazyest-gallery (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitra | low | 2.6 | 2% |
| CVE-2019-15867 | slick-popup (WordPress plugin) | The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber ca | high | 8.8 | 2% |
| CVE-2022-0346 | xml-sitemap-generator (WordPress plugin) | The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thu | medium | 6.1 | 2% |
| CVE-2013-3262 | download-monitor (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attack | medium | 4.3 | 2% |
| CVE-2015-5485 | eventbrite-tickets (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plug | medium | 4.3 | 2% |
| CVE-2019-15074 | mantisbt/mantisbt | MantisBT allows cross-site scripting (XSS) via crafted filename | medium | 0.0 | 2% |
| CVE-2015-5532 | paid-memberships-pro (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote att | medium | 6.1 | 2% |
| CVE-2014-4549 | sagepay-direct-for-woocommerce-payment-gateway (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before | medium | 4.3 | 2% |
| CVE-2014-6243 | ewww-image-optimizer (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arb | medium | 4.3 | 2% |
| CVE-2022-0288 | ad-inserter (WordPress plugin), ad-inserter-pro (WordPress plugin) | The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_s | medium | 6.1 | 2% |
| CVE-2012-6628 | newsletter-manager (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to in | medium | 4.3 | 2% |
| CVE-2013-1407 | events-manager (WordPress plugin), events-manager-pro (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for | medium | 4.3 | 2% |
| CVE-2013-6342 | tweet-blender (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Tweet Blender plugin before 4.0.2 for WordPress allows remote attackers to inject arbitrary | medium | 4.3 | 2% |
| CVE-2014-8724 | w3-total-cache (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remot | medium | 4.3 | 2% |
| CVE-2015-5481 | gd-bbpress-attachments (WordPress plugin) | Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote att | medium | 4.3 | 2% |
| CVE-2013-1758 | watermark (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2016-5833 | WordPress core | Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before | medium | 6.1 | 2% |
| CVE-2014-2315 | thank-you-counter-button (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inj | medium | 4.3 | 2% |
| CVE-2018-20153 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causi | medium | 5.4 | 2% |