Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-4521 | dsidxpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attacker | medium | 4.3 | 2% |
| CVE-2014-4532 | garagesale (WordPress plugin) | Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress | medium | 4.3 | 2% |
| CVE-2014-4597 | wp-social-invitations (WordPress plugin) | Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations plugin before 1.4.4.3 for WordPress allows remote attacker | medium | 4.3 | 2% |
| CVE-2016-5704 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2016-5732 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2014-4017 | conversion-ninja (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Conversion Ninja plugin for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2016-2040 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 5.4 | 2% |
| CVE-2014-10012 | awp-classifieds (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-3870 | bib2html (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the bib2html plugin 0.9.3 for WordPress allows remote attackers to inject arbitrary web script o | medium | 4.3 | 2% |
| CVE-2014-3921 | simple-popup (WordPress plugin) | Cross-site scripting (XSS) vulnerability in popup.php in the Simple Popup Images plugin for WordPress allows remote attackers to inject arbi | medium | 4.3 | 2% |
| CVE-2014-4724 | custom-banners (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web | medium | 4.3 | 2% |
| CVE-2014-8364 | wordpress-spreadsheet-plugin (WordPress plugin) | Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attac | medium | 4.3 | 2% |
| CVE-2014-8955 | clean-and-simple-contact-form (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) plugin 4.4.0 a | medium | 4.3 | 2% |
| CVE-2014-9100 | whydowork-adsense (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2014-9453 | simple-visitor-stat (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in simple-visitor-stat.php in the Simple visitor stat plugin for WordPress allow remote | medium | 4.3 | 2% |
| CVE-2015-2040 | contact-form-db (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPr | medium | 4.3 | 2% |
| CVE-2018-14504 | mantisbt/mantisbt | MantisBT allows XSS on the Edit Filter page via crafted filter name | medium | 6.1 | 2% |
| CVE-2021-24214 | openid-connect-generic-client (WordPress plugin) | The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, lead | medium | 6.1 | 2% |
| CVE-2011-5307 | photosmash (WordPress plugin) | Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitra | medium | 4.3 | 2% |
| CVE-2014-4516 | bic-media-widget (WordPress plugin) | Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows re | medium | 4.3 | 2% |
| CVE-2014-4517 | cbi-referral-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows re | medium | 4.3 | 2% |
| CVE-2014-4518 | contactme (WordPress plugin) | Cross-site scripting (XSS) vulnerability in xd_resize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows r | medium | 4.3 | 2% |
| CVE-2014-4522 | dssearchagent (WordPress plugin) | Cross-site scripting (XSS) vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for Word | medium | 4.3 | 2% |
| CVE-2014-4526 | efence (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress allow remote attack | medium | 4.3 | 2% |
| CVE-2014-4528 | fbpromotions (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromo | medium | 4.3 | 2% |
| CVE-2014-4531 | game-tabs (WordPress plugin) | Cross-site scripting (XSS) vulnerability in main_page.php in the Game tabs plugin 0.4.0 and earlier for WordPress allows remote attackers to | medium | 4.3 | 2% |
| CVE-2014-4533 | geo-redirector (WordPress plugin) | Cross-site scripting (XSS) vulnerability in ajax_functions.php in the GEO Redirector plugin 1.0.1 and earlier for WordPress allows remote at | medium | 4.3 | 2% |
| CVE-2014-4537 | keyword-strategy-internal-links (WordPress plugin) | Cross-site scripting (XSS) vulnerability in inpage.tpl.php in the Keyword Strategy Internal Links plugin 2.0 and earlier for WordPress allow | medium | 4.3 | 2% |
| CVE-2014-4538 | malware-finder (WordPress plugin) | Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers t | medium | 4.3 | 2% |
| CVE-2014-4540 | oleggo-livestream (WordPress plugin) | Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for Word | medium | 4.3 | 2% |
| CVE-2014-4541 | omfg-mobile (WordPress plugin) | Cross-site scripting (XSS) vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earl | medium | 4.3 | 2% |
| CVE-2014-4542 | ooorl (WordPress plugin) | Cross-site scripting (XSS) vulnerability in redirect.php in the Ooorl plugin for WordPress allows remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2014-4546 | rezgo (WordPress plugin) | Cross-site scripting (XSS) vulnerability in book_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inj | medium | 4.3 | 2% |
| CVE-2014-4551 | social-connect (WordPress plugin) | Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and earlier for WordPress allows remote | medium | 4.3 | 2% |
| CVE-2014-4552 | spotlightyour (WordPress plugin) | Cross-site scripting (XSS) vulnerability in library/includes/payment/paypalexpress/DoDirectPayment.php in the Spotlight (spotlightyour) plug | medium | 4.3 | 2% |
| CVE-2014-4555 | style-it (WordPress plugin) | Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers | medium | 4.3 | 2% |
| CVE-2014-4556 | swipe-checkout-for-eshop (WordPress plugin) | Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows re | medium | 4.3 | 2% |
| CVE-2014-4557 | swipe-hq-checkout-for-jigoshop (WordPress plugin) | Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) plugin 3.1.0 | medium | 4.3 | 2% |
| CVE-2014-4560 | toolpage (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/getTipo.php in the ToolPage plugin 1.6.1 and earlier for WordPress allows remote attack | medium | 4.3 | 2% |
| CVE-2014-4563 | url-cloak-\&-encrypt (WordPress plugin) | Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allow | medium | 4.3 | 2% |
| CVE-2014-4564 | validated-plugin (WordPress plugin) | Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inj | medium | 4.3 | 2% |
| CVE-2014-4565 | verification-code-for-comments (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPre | medium | 4.3 | 2% |
| CVE-2014-4566 | verweise-wordpress-twitter (WordPress plugin) | Cross-site scripting (XSS) vulnerability in res/fake_twitter/frame.php in the "verwei.se - WordPress - Twitter" (verweise-wordpress-twitter) | medium | 4.3 | 2% |
| CVE-2014-4572 | votecount-for-balatarin (WordPress plugin) | Cross-site scripting (XSS) vulnerability in bvc.php in the Votecount for Balatarin plugin 0.1.1 and earlier for WordPress allows remote atta | medium | 4.3 | 2% |
| CVE-2014-4573 | walk-score (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in frame-maker.php in the Walk Score plugin 0.5.5 and earlier for WordPress allow remote | medium | 4.3 | 2% |
| CVE-2014-4575 | wikipop (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inj | medium | 4.3 | 2% |
| CVE-2014-4576 | wordpress-social-login (WordPress plugin) | Cross-site scripting (XSS) vulnerability in services/diagnostics.php in the WordPress Social Login plugin 2.0.3 and earlier for WordPress al | medium | 4.3 | 2% |
| CVE-2014-4578 | wp-app-maker (WordPress plugin) | Cross-site scripting (XSS) vulnerability in asset-studio/icons-launcher.php in the WP App Maker plugin 1.0.16.4 and earlier for WordPress al | medium | 4.3 | 2% |
| CVE-2014-4579 | wp-appointments-schedules (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/test.php in the Appointments Scheduler plugin 1.5 and earlier for WordPress allows remote att | medium | 4.3 | 2% |
| CVE-2014-4580 | wp-blipbot (WordPress plugin) | Cross-site scripting (XSS) vulnerability in blipbot.ajax.php in the WP BlipBot plugin 3.0.9 and earlier for WordPress allows remote attacker | medium | 4.3 | 2% |