Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-100007 | hk-exif-tags (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject ar | medium | 4.3 | 2% |
| CVE-2014-9174 | google-analytics-for-wordpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress | medium | 4.3 | 2% |
| CVE-2015-0901 | flashy (WordPress theme) | Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitra | medium | 4.3 | 2% |
| CVE-2015-1383 | geo-mashup (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attacker | medium | 4.3 | 2% |
| CVE-2020-11727 | woo-order-export-lite (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote a | medium | 6.1 | 2% |
| CVE-2020-29303 | directories-pro (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arb | medium | 6.1 | 2% |
| CVE-2014-7152 | yikes-inc-easy-mailchimp-extender (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to injec | medium | 4.3 | 2% |
| CVE-2022-1916 | woot (WordPress plugin) | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not saniti | medium | 6.1 | 2% |
| CVE-2014-100026 | aprils-super-functions-pack (WordPress plugin) | Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote a | medium | 4.3 | 2% |
| CVE-2016-4855 | adodb/adodb-php | ADOdb Cross-site scripting vulnerability in old test script | medium | 6.1 | 2% |
| CVE-2018-17960 | typo3/cms, typo3/cms-core | Ckeditor XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2022-3242 | microweber/microweber | Microweber Cross-site Scripting can result in redirection to a malicious site | medium | 6.1 | 2% |
| CVE-2019-17214 | webarx (WordPress plugin) | The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI. | high | 7.5 | 2% |
| CVE-2022-0271 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_backgro | medium | 6.1 | 2% |
| CVE-2022-1756 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. | medium | 6.1 | 2% |
| CVE-2021-24987 | super-socializer (WordPress plugin) | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in | medium | 6.1 | 2% |
| CVE-2011-0451 | ec-cube/ec-cube | EC-CUBE XSS Vulnerabilities | medium | 0.0 | 2% |
| CVE-2017-18598 | qards (WordPress plugin) | The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php. | medium | 6.1 | 2% |
| CVE-2025-1232 | site-reviews (WordPress plugin) | The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenti | high | 8.8 | 2% |
| CVE-2017-9061 | WordPress core | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error m | medium | 6.1 | 2% |
| CVE-2012-4968 | silverstripe/framework | Silverstripe XSS Vulnerabilities | medium | 0.0 | 2% |
| CVE-2015-3935 | dolibarr/dolibarr | Dolibarr ERP and CRM contain Cross-site Scripting Vulnerability | medium | 0.0 | 2% |
| CVE-2021-25016 | chaty (WordPress plugin), chaty-pro (WordPress plugin) | The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before o | medium | 6.1 | 2% |
| CVE-2021-24452 | w3-total-cache (WordPress plugin) | The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" paramet | medium | 6.1 | 2% |
| CVE-2015-7357 | udesign (WordPress theme) | Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to in | medium | 6.1 | 2% |
| CVE-2021-24436 | w3-total-cache (WordPress plugin) | The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the | medium | 6.1 | 2% |
| CVE-2020-26934 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting (XSS) | medium | 6.1 | 2% |
| CVE-2018-9034 | relevanssi (WordPress plugin) | Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject | medium | 5.4 | 2% |
| CVE-2010-2958 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting vulnerability | medium | 0.0 | 2% |
| CVE-2014-8087 | post-highlights (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 2% |
| CVE-2014-8584 | player (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPres | medium | 4.3 | 2% |
| CVE-2015-1039 | zf-commons/zfc-user | ZF-Commons ZfcUser Vulnerable to XSS in Login Redirect | medium | 5.3 | 2% |
| CVE-2019-16219 | WordPress core | WordPress before 5.2.3 allows XSS in shortcode previews. | medium | 6.1 | 2% |
| CVE-2015-4557 | nextend-twitter-connect (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Conne | medium | 6.1 | 2% |
| CVE-2019-19133 | csshero (WordPress plugin) | The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails | medium | 6.1 | 2% |
| CVE-2020-8549 | strong-testimonials (WordPress plugin) | Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stea | medium | 6.1 | 2% |
| CVE-2022-0963 | microweber/microweber | Unrestricted XML files leading to cross-site scripting in Microweber | medium | 5.4 | 2% |
| CVE-2020-11509 | wp-lead-plus-x (WordPress plugin) | An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arb | medium | 6.1 | 2% |
| CVE-2021-24228 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPr | critical | 9.6 | 2% |
| CVE-2019-10913 | symfony/http-foundation, symfony/symfony | Invalid HTTP method overrides allow possible XSS or other attacks in Symfony | critical | 9.8 | 2% |
| CVE-2022-1007 | advanced-booking-calendar (WordPress plugin) | The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an | medium | 6.1 | 2% |
| CVE-2018-20583 | league/commonmark | PHP League CommonMark vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 2% |
| CVE-2014-6300 | phpmyadmin/phpmyadmin | phpMyAdmin micro history Implementation XSS Vulnerability | medium | 0.0 | 2% |
| CVE-2022-1724 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX act | medium | 6.1 | 2% |
| CVE-2022-1168 | jobsearch-wp-job-board (WordPress plugin) | There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1. | medium | 6.1 | 2% |
| CVE-2014-0218 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | medium | 0.0 | 2% |
| CVE-2016-0765 | eshop-plugin (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to i | medium | 6.1 | 2% |
| CVE-2020-3715 | magento/community-edition, magento/core | Magento stored cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2020-3758 | magento/community-edition, magneto/core | Magento stored cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2015-5612 | october/october | October CMS XSS In Caption Tag of Profile | medium | 0.0 | 2% |