Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-5191 | ckeditor/ckeditor | The Preview plugin in CKEditor allows Cross-site scripting (XSS) | medium | 0.0 | 2% |
| CVE-2022-1937 | awin-data-feed (WordPress plugin) | The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (availa | medium | 6.1 | 2% |
| CVE-2010-5098 | typo3/cms-frontend | TYPO3 Cross-site scripting (XSS) vulnerability in the FORM content object | low | 0.0 | 2% |
| CVE-2015-7562 | nilsteampassnet/teampass | TeamPass vulnerable to Cross-site Scripting | medium | 6.1 | 2% |
| CVE-2011-4278 | moodle/moodle | Moodle XSS In Tag Autocomplete functionality | medium | 0.0 | 2% |
| CVE-2011-4282 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2011-4286 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | medium | 0.0 | 2% |
| CVE-2011-4306 | moodle/moodle | Moodle XSS Vulnerability | medium | 0.0 | 2% |
| CVE-2014-3548 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | medium | 0.0 | 2% |
| CVE-2014-9059 | moodle/moodle | Moodle does not provide charset information in HTTP headers | medium | 0.0 | 2% |
| CVE-2018-20966 | woocommerce-jetpack (WordPress plugin) | The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature. | medium | 6.1 | 2% |
| CVE-2021-33557 | mantisbt/mantisbt | MantisBT allows XSS in manage_custom_field_edit_page.php | medium | 6.1 | 2% |
| CVE-2012-6147 | typo3/cms | Typo3 Backend API XSS Vulnerability | low | 0.0 | 2% |
| CVE-2010-5295 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary | medium | 4.3 | 2% |
| CVE-2010-1618 | apereo/phpcas, moodle/moodle | phpCAS client library and Moodle Cross-site Scripting vulnerability | medium | 0.0 | 2% |
| CVE-2011-4955 | bsuite (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attacke | medium | 6.1 | 2% |
| CVE-2022-0533 | ditty-news-ticker (WordPress plugin) | The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability. | medium | 6.1 | 2% |
| CVE-2018-10752 | tagregator (WordPress plugin) | The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action. | medium | 4.8 | 2% |
| CVE-2019-16218 | WordPress core | WordPress before 5.2.3 allows XSS in stored comments. | medium | 6.1 | 2% |
| CVE-2013-6289 | apache-solr-for-typo3/solr | Apache Solr for TYPO3 (solr) extension is vulnerable to Cross-site scripting (XSS) | medium | 4.3 | 2% |
| CVE-2015-9312 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element. | medium | 6.1 | 2% |
| CVE-2016-4833 | nofollow-links (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 2% |
| CVE-2010-2574 | mantisbt/mantisbt | MantisBT Cross-site Scripting vulnerability | low | 0.0 | 2% |
| CVE-2021-24545 | wp-html-author-bio (WordPress plugin) | The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious | medium | 5.4 | 2% |
| CVE-2022-0970 | getgrav/grav | Stored Cross-site Scripting in grav | high | 7.1 | 2% |
| CVE-2011-4340 | symphonycms/symphony-2 | Symphony CMS vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2019-11843 | mailpoet (WordPress plugin) | The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the | medium | 6.1 | 2% |
| CVE-2012-5888 | b13/seo_basics | Basic SEO Features (seo_basics) extension TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2016-0770 | connections (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for Wo | medium | 6.1 | 2% |
| CVE-2022-1170 | jobmonster (WordPress plugin) | In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided th | medium | 6.1 | 2% |
| CVE-2015-7666 | payment-form-for-paypal-pro (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_i | medium | 6.1 | 2% |
| CVE-2015-8834 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web | medium | 6.1 | 2% |
| CVE-2018-12581 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2017-9062 | WordPress core | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. | high | 8.6 | 2% |
| CVE-2022-1946 | gallery (WordPress plugin) | The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX acti | medium | 6.1 | 2% |
| CVE-2015-8766 | symphonycms/symphony-2 | Symphony CMS XSS Vulnerabilities | medium | 6.1 | 2% |
| CVE-2019-16221 | WordPress core | WordPress before 5.2.3 allows reflected XSS in the dashboard. | medium | 6.1 | 2% |
| CVE-2015-3299 | floating-social-bar (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbi | medium | 6.1 | 2% |
| CVE-2019-17672 | WordPress core | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. | medium | 6.1 | 2% |
| CVE-2013-5739 | WordPress core | The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote a | low | 3.5 | 2% |
| CVE-2022-0234 | woocs (WordPress plugin) | The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price | medium | 6.1 | 2% |
| CVE-2021-24229 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon W | critical | 9.6 | 2% |
| CVE-2017-18528 | pdf-print (WordPress plugin) | The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-5488 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject a | medium | 6.1 | 2% |
| CVE-2016-5731 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site scripting (XSS) vulnerability | medium | 6.1 | 2% |
| CVE-2017-7897 | mantisbt/mantisbt | MantisBT XSS via my_view_page.php and view_user_page.php | medium | 6.1 | 2% |
| CVE-2019-9553 | bolt/bolt | Bolt Cross-site Scripting via the slug, teaser or title parameters | medium | 6.1 | 2% |
| CVE-2021-24233 | cooked (WordPress plugin) | The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper saniti | medium | 6.1 | 2% |
| CVE-2014-3551 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | low | 0.0 | 2% |
| CVE-2012-6633 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbi | medium | 4.3 | 2% |