Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-18519 | customer-area (WordPress plugin) | The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages. | medium | 6.1 | 1% |
| CVE-2017-18522 | eelv-newsletter (WordPress plugin) | The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book. | medium | 6.1 | 1% |
| CVE-2017-18524 | football-pool (WordPress plugin) | The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18525 | megamenu (WordPress plugin) | The megamenu plugin before 2.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18526 | moreads-se (WordPress plugin) | The moreads-se plugin before 1.4.7 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18531 | raygun4wp (WordPress plugin) | The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288. | medium | 6.1 | 1% |
| CVE-2017-18533 | rimons-twitter-widget (WordPress plugin) | The rimons-twitter-widget plugin before 1.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18534 | share-on-diaspora (WordPress plugin) | The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters. | medium | 6.1 | 1% |
| CVE-2017-18535 | smokesignal (WordPress plugin) | The smokesignal plugin before 1.2.7 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18553 | ad-buttons (WordPress plugin) | The ad-buttons plugin before 2.3.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18554 | analytics-tracker (WordPress plugin) | The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event. | medium | 6.1 | 1% |
| CVE-2017-18555 | booking-sms (WordPress plugin) | The booking-sms plugin before 1.1.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18560 | content-audit (WordPress plugin) | The content-audit plugin before 1.9.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18561 | embed-comment-images (WordPress plugin) | The embed-comment-images plugin before 0.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18563 | rsvp (WordPress plugin) | The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen. | medium | 6.1 | 1% |
| CVE-2017-18567 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.4.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18568 | my-wp-translate (WordPress plugin) | The my-wp-translate plugin before 1.0.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18576 | event-notifier (WordPress plugin) | The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation. | medium | 6.1 | 1% |
| CVE-2017-18577 | mailchimp-for-wp (WordPress plugin) | The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg. | medium | 6.1 | 1% |
| CVE-2017-18578 | crafty-social-buttons (WordPress plugin) | The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18579 | corner-ad (WordPress plugin) | The corner-ad plugin before 1.0.8 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18581 | time-sheets (WordPress plugin) | The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list. | medium | 6.1 | 1% |
| CVE-2017-18582 | time-sheets (WordPress plugin) | The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18591 | gd-rating-system (WordPress plugin) | The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php. | medium | 6.1 | 1% |
| CVE-2018-11198 | mautic/core | XSS vulnerability in Author URL of themes in Mautic | medium | 6.1 | 1% |
| CVE-2018-11317 | intelliants/subrion | Subrion CMS XSS | medium | 6.1 | 1% |
| CVE-2018-16254 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vul | medium | 6.1 | 1% |
| CVE-2018-20978 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.4.7 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2018-20983 | wp-retina-2x (WordPress plugin) | The wp-retina-2x plugin before 5.2.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2018-21001 | anycomment (WordPress plugin) | The anycomment plugin before 0.0.33 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2020-35037 | events-manager (WordPress plugin) | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which co | medium | 6.1 | 1% |
| CVE-2021-24885 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Ref | medium | 6.1 | 1% |
| CVE-2021-25027 | powerpack-addons-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute | medium | 6.1 | 1% |
| CVE-2021-39325 | optinmonster (WordPress plugin) | The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews | medium | 6.1 | 1% |
| CVE-2023-6592 | fastdup (WordPress plugin) | The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files. | medium | 5.3 | 1% |
| CVE-2026-81891 | studio-42/elfinder | elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) | high | 8.1 | 1% |
| CVE-2022-1208 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user pr | medium | 6.4 | 1% |
| CVE-2016-10963 | icegram (WordPress plugin) | The icegram plugin before 1.9.19 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10979 | fossura-tag-miner (WordPress plugin) | The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2024-6289 | wps-hide-login (WordPress plugin) | The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, a | medium | 6.1 | 1% |
| CVE-2017-1000509 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2024-0588 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 4.3 | 1% |
| CVE-2022-42459 | image-hover-effects-ultimate (WordPress plugin) | Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress. | high | 7.2 | 1% |
| CVE-2010-3661 | typo3/cms-backend | TYPO3 Open Redirection vulnerability on the backend | medium | 6.1 | 1% |
| CVE-2024-11252 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon | medium | 6.1 | 1% |
| CVE-2024-40101 | microweber/microweber | Microweber Reflected Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2022-0558 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2020-29605 | mantisbt/mantisbt | MantisBT Incorrect Authorization in bug_actiongroup_page.php | medium | 0.0 | 1% |
| CVE-2026-72819 | getgrav/grav | Grav CMS vulnerable to remote code execution via .zip file upload | high | 8.8 | 1% |
| CVE-2023-2761 | user-activity-log (WordPress plugin) | The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL | high | 7.2 | 1% |