Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-100023 | mtouch-quiz (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to | medium | 4.3 | 2% |
| CVE-2014-4520 | dmca-watermarker (WordPress plugin) | Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker plugin before 1.1 for WordPress allows remote attackers to i | medium | 4.3 | 2% |
| CVE-2014-4524 | easy-post-types (WordPress plugin) | Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allow | medium | 4.3 | 2% |
| CVE-2014-4554 | ss-downloads (WordPress plugin) | Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads plugin before 1.5 for WordPress allows remote attacke | medium | 4.3 | 2% |
| CVE-2014-4569 | videowhisper-live-streaming-integration (WordPress plugin) | Cross-site scripting (XSS) vulnerability in ls/vv_login.php in the VideoWhisper Live Streaming Integration plugin 4.27.2 and earlier for Wor | medium | 4.3 | 2% |
| CVE-2014-4574 | webengage (WordPress plugin) | Cross-site scripting (XSS) vulnerability in resize.php in the WebEngage plugin before 2.0.1 for WordPress allows remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4594 | wp-responsive-preview (WordPress plugin) | Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote atta | medium | 4.3 | 2% |
| CVE-2015-1384 | banner-effect-header (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arb | medium | 4.3 | 2% |
| CVE-2021-24176 | jh-404-logger (WordPress plugin) | The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, wh | medium | 5.4 | 2% |
| CVE-2011-5304 | sodahead-polls (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Sodahead Polls plugin before 2.0.4 for WordPress allow remote attackers to inject | medium | 4.3 | 2% |
| CVE-2012-4226 | quick-post-widget (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitra | medium | 4.3 | 2% |
| CVE-2013-7129 | blooog-theme (WordPress theme) | Cross-site scripting (XSS) vulnerability in ThemeBeans Blooog theme 1.1 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2014-100008 | js-multi-hotel (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) | medium | 4.3 | 2% |
| CVE-2014-100016 | photocrati (WordPress theme) | Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress allows remote attackers | medium | 4.3 | 2% |
| CVE-2014-10016 | e-commerce (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject a | medium | 4.3 | 2% |
| CVE-2014-7139 | contact-form-7-to-database-extension (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before | medium | 4.3 | 2% |
| CVE-2014-7956 | pods (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2014-9176 | sexy-squeeze-pages (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject arbit | medium | 4.3 | 2% |
| CVE-2015-2069 | woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary w | medium | 4.3 | 2% |
| CVE-2015-2220 | ninja-forms (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to injec | medium | 4.3 | 2% |
| CVE-2015-2973 | welcart-e-commerce (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbit | medium | 4.3 | 2% |
| CVE-2022-0208 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad | medium | 6.1 | 2% |
| CVE-2017-18536 | stop-user-enumeration (WordPress plugin) | The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS. | medium | 6.1 | 2% |
| CVE-2012-3528 | typo3/cms | Typo3 Backend XSS Vulnerability | low | 0.0 | 2% |
| CVE-2013-1759 | responsive-logo-slideshow (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary w | medium | 4.3 | 2% |
| CVE-2013-5916 | bradesco-gateway (WordPress plugin) | Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, | medium | 4.3 | 2% |
| CVE-2014-100018 | unconfirmed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2014-100027 | wp-slimstat (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2014-4570 | videowhisper-video-presentation (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Video Presentation plugin before 3.31 for WordPress allow remote att | medium | 4.3 | 2% |
| CVE-2014-6313 | woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2019-14799 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. | medium | 6.1 | 2% |
| CVE-2018-5776 | WordPress core | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). | medium | 6.1 | 2% |
| CVE-2010-2479 | ezyang/htmlpurifier | HTML Purifier Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 2% |
| CVE-2020-12696 | iframe (WordPress plugin) | The iframe plugin before 4.5 for WordPress does not sanitize a URL. | medium | 6.1 | 2% |
| CVE-2015-5956 | typo3/cms | TYPO3 cross-site scripting (XSS) | low | 0.0 | 2% |
| CVE-2017-9063 | WordPress core | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization s | medium | 6.1 | 2% |
| CVE-2020-35572 | vrana/adminer | vrana/adminer via XSS in the history parameter in SQL command | medium | 6.1 | 2% |
| CVE-2018-13832 | all-in-one-favicon (WordPress plugin) | Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPres | medium | 4.8 | 2% |
| CVE-2019-15816 | wp-private-content-plus (WordPress plugin) | The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ | high | 7.5 | 2% |
| CVE-2023-6000 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript | medium | 6.1 | 2% |
| CVE-2009-3821 | apache-solr-for-typo3/solr | Apache Solr Search for TYPO3 vulnerable to Cross-site Scripting | medium | 0.0 | 2% |
| CVE-2017-17094 | WordPress core | wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to | medium | 5.4 | 2% |
| CVE-2013-7419 | js-multi-hotel (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) | medium | 4.3 | 2% |
| CVE-2012-6623 | forumpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress a | medium | 4.3 | 2% |
| CVE-2021-24342 | jnews (WordPress plugin) | The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_bui | medium | 6.1 | 2% |
| CVE-2021-24364 | jannah (WordPress plugin) | The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before | medium | 6.1 | 2% |
| CVE-2017-17093 | WordPress core | wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might all | medium | 5.4 | 2% |
| CVE-2013-5098 | download-monitor (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attack | medium | 4.3 | 2% |
| CVE-2017-6817 | WordPress core | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. | medium | 5.4 | 2% |
| CVE-2009-3636 | typo3/cms-install | Typo3 API Install Tool vulnerable to Cross-site Scripting | medium | 0.0 | 2% |