Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2013-7480 | events-manager (WordPress plugin) | The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. | medium | 6.1 | 1% |
| CVE-2013-7482 | reflex-gallery (WordPress plugin) | The reflex-gallery plugin before 1.4.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2014-10378 | duplicate-post (WordPress plugin) | The duplicate-post plugin before 2.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2014-10380 | profile-builder (WordPress plugin) | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms. | medium | 6.1 | 1% |
| CVE-2014-10386 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections. | medium | 6.1 | 1% |
| CVE-2014-10391 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection. | medium | 6.1 | 1% |
| CVE-2014-10393 | cforms2 (WordPress plugin) | The cforms2 plugin before 10.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2014-10394 | rich-counter (WordPress plugin) | The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header. | medium | 6.1 | 1% |
| CVE-2014-10395 | cp-polls (WordPress plugin) | The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list. | medium | 6.1 | 1% |
| CVE-2015-9317 | awesome-support (WordPress plugin) | The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages. | medium | 6.1 | 1% |
| CVE-2015-9319 | gregs-high-performance-seo (WordPress plugin) | The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser. | medium | 6.1 | 1% |
| CVE-2015-9321 | shortcode-factory (WordPress plugin) | The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg. | medium | 6.1 | 1% |
| CVE-2015-9327 | flickr-justified-gallery (WordPress plugin) | The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9329 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2015-9342 | wp-rollback (WordPress plugin) | The wp-rollback plugin before 1.2.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9346 | cp-polls (WordPress plugin) | The cp-polls plugin before 1.0.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9347 | wp-plotly (WordPress plugin) | The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors. | medium | 6.1 | 1% |
| CVE-2015-9349 | ckeditor-for-wordpress (WordPress plugin) | The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser. | medium | 6.1 | 1% |
| CVE-2015-9350 | feed-them-social (WordPress plugin) | The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button. | medium | 6.1 | 1% |
| CVE-2016-10895 | option-tree (WordPress plugin) | The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request. | medium | 6.1 | 1% |
| CVE-2016-10896 | seo-redirection (WordPress plugin) | The seo-redirection plugin before 4.3 for WordPress has stored XSS. | medium | 6.1 | 1% |
| CVE-2016-10897 | sermon-browser (WordPress plugin) | The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2016-10898 | total-security (WordPress plugin) | The total-security plugin before 3.4.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10900 | uji-countdown (WordPress plugin) | The uji-countdown plugin before 2.0.7 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10901 | wp-customer-reviews (WordPress plugin) | The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools. | medium | 6.1 | 1% |
| CVE-2016-10908 | booking-calendar-contact-form (WordPress plugin) | The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10910 | formbuilder (WordPress plugin) | The formbuilder plugin before 1.06 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2016-10911 | profile-builder (WordPress plugin) | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2016-10912 | universal-analytics (WordPress plugin) | The universal-analytics plugin before 1.3.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10913 | wp-latest-posts (WordPress plugin) | The wp-latest-posts plugin before 3.7.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10934 | check-email (WordPress plugin) | The check-email plugin before 0.5.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-17096 | content-cards (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary | medium | 6.1 | 1% |
| CVE-2019-15110 | wp-front-end-profile (WordPress plugin) | The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-15327 | import-users-from-csv-with-meta (WordPress plugin) | The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. | medium | 6.1 | 1% |
| CVE-2019-15331 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. | medium | 6.1 | 1% |
| CVE-2020-25102 | silverstripe-australia/advancedreports | silverstripe-advancedreports vulnerable to XSS | medium | 6.1 | 1% |
| CVE-2016-10763 | camptix (WordPress plugin) | The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body. | medium | 4.8 | 1% |
| CVE-2022-3173 | snipe/snipe-it | Snipe-IT vulnerable to Improper Authentication | medium | 4.3 | 1% |
| CVE-2024-2381 | ali2woo-lite (WordPress plugin) | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati | high | 8.8 | 1% |
| CVE-2022-46170 | codeigniter4/framework | CodeIgniter4 Potential Session Handlers Vulnerability | high | 8.6 | 1% |
| CVE-2021-24639 | omgf (WordPress plugin) | The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX actio | high | 8.1 | 1% |
| CVE-2022-24739 | rudloff/alltube | Server-Side Request Forgery and Open Redirect in AllTube Download | high | 7.3 | 1% |
| CVE-2022-4373 | quote-o-matic (WordPress plugin) | The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leadi | high | 7.2 | 1% |
| CVE-2017-20008 | mycred (WordPress plugin) | The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin d | medium | 6.1 | 1% |
| CVE-2022-4301 | sunshine-photo-cart (WordPress plugin) | The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leadi | medium | 6.1 | 1% |
| CVE-2022-4325 | post-status-notifier-lite (WordPress plugin) | The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 1% |
| CVE-2022-3933 | essential-real-estate (WordPress plugin) | The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role a | medium | 5.4 | 1% |
| CVE-2022-3934 | flat-pm (WordPress plugin) | The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Refl | medium | 5.4 | 1% |
| CVE-2014-2274 | subscribe-to-comments-reloaded (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attac | high | 8.8 | 1% |
| CVE-2016-10989 | leenkme (WordPress plugin) | The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF. | high | 8.8 | 1% |