Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-24408 | magento/community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2021-24409 | prismatic (WordPress plugin) | The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a re | medium | 6.1 | 2% |
| CVE-2020-28034 | WordPress core | WordPress before 5.5.2 allows XSS associated with global variables. | medium | 6.1 | 2% |
| CVE-2018-9861 | drupal/core, drupal/drupal | CKEditor, a third-party JavaScript library included in Drupal core, has [fixed a cross-site scripting (XSS) vulnerabilit | medium | 6.1 | 2% |
| CVE-2022-0150 | wp-accessibility-helper (WordPress plugin) | The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its | medium | 6.1 | 2% |
| CVE-2022-0248 | contact-form-submissions (WordPress plugin) | The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before ou | medium | 6.1 | 2% |
| CVE-2016-2559 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site scripting (XSS) vulnerability in SQL parser | medium | 5.4 | 2% |
| CVE-2020-29470 | opencart/opencart | OpenCart Cross-site Scripting (XSS) in the Subject field of mail. | medium | 4.8 | 2% |
| CVE-2023-2023 | custom-404-pro (WordPress plugin) | The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross- | medium | 6.1 | 2% |
| CVE-2016-10973 | brafton (WordPress plugin) | The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage | medium | 6.1 | 2% |
| CVE-2022-1933 | collect-and-deliver-interface-for-woocommerce (WordPress plugin) | The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action ( | medium | 6.1 | 2% |
| CVE-2021-36026 | magento/community-edition, magento/project-community-edition | Magento stored cross-site scripting vulnerability in the customer address upload feature | medium | 0.0 | 2% |
| CVE-2018-15605 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting (XSS) in the import dialog | medium | 6.1 | 2% |
| CVE-2019-16780 | WordPress core | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is | medium | 5.8 | 2% |
| CVE-2017-18516 | bws-linkedin (WordPress plugin) | The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18527 | pagination (WordPress plugin) | The pagination plugin before 1.0.7 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2022-2219 | unyson (WordPress plugin) | The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | high | 7.2 | 2% |
| CVE-2020-25830 | mantisbt/mantisbt | MantisBT HTML Injection vulnerability | medium | 4.8 | 2% |
| CVE-2021-24319 | bello (WordPress plugin) | The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back | medium | 5.4 | 2% |
| CVE-2015-5151 | slider-revolution (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject a | medium | 4.3 | 2% |
| CVE-2016-10928 | onelogin-saml-sso (WordPress plugin) | The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users. | high | 7.5 | 2% |
| CVE-2020-35128 | mautic/core | Mautic stored Cross-site Scripting (XSS) | critical | 9.0 | 2% |
| CVE-2021-24910 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available | medium | 6.1 | 2% |
| CVE-2020-35936 | post-grid (WordPress plugin), team-showcase (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers t | high | 7.5 | 2% |
| CVE-2020-35937 | post-grid (WordPress plugin), team-showcase (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attack | high | 7.5 | 2% |
| CVE-2019-19211 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2010-1614 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2010-1619 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2014-8809 | wp-symposium (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject a | medium | 4.3 | 2% |
| CVE-2019-17599 | quiz-master-next (WordPress plugin) | The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact i | medium | 6.1 | 2% |
| CVE-2019-7299 | wp-support-plus-responsive-ticket-system (WordPress plugin) | A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1 | medium | 6.1 | 2% |
| CVE-2019-9914 | yop-poll (WordPress plugin) | The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS. | medium | 6.1 | 2% |
| CVE-2021-24875 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting i | medium | 6.1 | 2% |
| CVE-2021-24979 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin | medium | 6.1 | 2% |
| CVE-2022-2796 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) | medium | 6.7 | 2% |
| CVE-2017-18502 | subscriber (WordPress plugin) | The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18505 | twitter-plugin (WordPress plugin) | The twitter-plugin plugin before 2.55 for WordPress has XSS. | medium | 6.1 | 2% |
| CVE-2021-25085 | woocommerce-products-filter (WordPress plugin) | The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leadi | medium | 6.1 | 2% |
| CVE-2014-4514 | alipay (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress a | medium | 4.3 | 2% |
| CVE-2015-1582 | spider-facebook (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to | medium | 4.3 | 2% |
| CVE-2012-6627 | newsletter-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remo | medium | 4.3 | 2% |
| CVE-2012-6630 | media-library-categories (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inj | medium | 4.3 | 2% |
| CVE-2012-3530 | typo3/cms | Typo3 API XSS Vulnerability | medium | 0.0 | 2% |
| CVE-2018-17866 | ultimate-member (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membershi | medium | 6.1 | 2% |
| CVE-2019-17207 | broken-link-checker (WordPress plugin) | A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11 | medium | 5.4 | 2% |
| CVE-2022-0250 | redirection-for-contact-form-7 (WordPress plugin) | The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, lead | medium | 6.1 | 2% |
| CVE-2023-1880 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter | high | 8.3 | 2% |
| CVE-2020-18325 | intelliants/subrion | Cross-site Scripting in intelliants/subrion | medium | 6.1 | 2% |
| CVE-2020-9019 | wpjobboard (WordPress plugin) | The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description. | medium | 6.1 | 2% |
| CVE-2013-7078 | typo3/cms-core | TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework | low | 0.0 | 2% |