Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-4581 | wpcb (WordPress plugin) | Cross-site scripting (XSS) vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4582 | wp-consultant (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/admin_show_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows re | medium | 4.3 | 2% |
| CVE-2014-4583 | wp-contact-sidebar-widget (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earli | medium | 4.3 | 2% |
| CVE-2014-4584 | wp-easybooking (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/editFacility.php in the wp-easybooking plugin 1.0.3 and earlier for WordPress allows remot | medium | 4.3 | 2% |
| CVE-2014-4585 | wp-facethumb (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WP-FaceThumb plugin possibly 1.0 and earlier for WordPress allows remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4590 | wp-microblogs (WordPress plugin) | Cross-site scripting (XSS) vulnerability in get.php in the WP Microblogs plugin 0.4.0 and earlier for WordPress allows remote attackers to i | medium | 4.3 | 2% |
| CVE-2014-4591 | wp-picasa-image (WordPress plugin) | Cross-site scripting (XSS) vulnerability in picasa_upload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote atta | medium | 4.3 | 2% |
| CVE-2014-4593 | wp-plugin-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPres | medium | 4.3 | 2% |
| CVE-2014-4595 | wp-restful (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4599 | wp-business-directory (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier | medium | 4.3 | 2% |
| CVE-2014-4601 | wu-rating (WordPress plugin) | Cross-site scripting (XSS) vulnerability in wu-ratepost.php in the Wu-Rating plugin 1.0 12319 and earlier for WordPress allows remote attack | medium | 4.3 | 2% |
| CVE-2014-4602 | xen-carousel (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in xencarousel-admin.js.php in the XEN Carousel plugin 0.12.2 and earlier for WordPress | medium | 4.3 | 2% |
| CVE-2014-4604 | your-text-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in settings/pwsettings.php in the Your Text Manager plugin 0.3.0 and earlier for WordPress allows r | medium | 4.3 | 2% |
| CVE-2014-4605 | zdstatistics (WordPress plugin) | Cross-site scripting (XSS) vulnerability in cal/test.php in the ZdStatistics (zdstats) plugin 2.0.1 and earlier for WordPress allows remote | medium | 4.3 | 2% |
| CVE-2014-4606 | zeenshare (WordPress plugin) | Cross-site scripting (XSS) vulnerability in redirect_to_zeenshare.php in the ZeenShare plugin 1.0.1 and earlier for WordPress allows remote | medium | 4.3 | 2% |
| CVE-2014-4723 | easy-banners (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2019-18834 | subscriptions (WordPress plugin) | Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript be | medium | 6.1 | 2% |
| CVE-2014-2040 | media-file-renamer (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions | low | 2.1 | 2% |
| CVE-2015-9407 | xpinner-lite (WordPress plugin) | The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS. | medium | 6.1 | 2% |
| CVE-2016-10992 | music-store (WordPress plugin) | The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter. | medium | 6.1 | 2% |
| CVE-2018-6465 | propertyhive (WordPress plugin) | The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-em | medium | 6.1 | 2% |
| CVE-2017-18517 | bws-pinterest (WordPress plugin) | The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18518 | bws-smtp (WordPress plugin) | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18529 | promobar (WordPress plugin) | The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2017-18537 | visitors-online (WordPress plugin) | The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues. | medium | 6.1 | 2% |
| CVE-2014-3923 | video-gallery (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attacke | medium | 4.3 | 2% |
| CVE-2014-4515 | anyfont (WordPress plugin) | Cross-site scripting (XSS) vulnerability in mce_anyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attac | medium | 4.3 | 2% |
| CVE-2014-4527 | envialosimple-email-marketing-y-newsletters-gratis (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters ( | medium | 4.3 | 2% |
| CVE-2014-4543 | pay-per-media-player (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress a | medium | 4.3 | 2% |
| CVE-2014-4545 | pro-quoter (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in pq_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote att | medium | 4.3 | 2% |
| CVE-2014-4547 | rezgo-online-booking (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for | medium | 4.3 | 2% |
| CVE-2014-4568 | video-posts-webcam-recorder (WordPress plugin) | Cross-site scripting (XSS) vulnerability in posts/videowhisper/r_logout.php in the Video Posts Webcam Recorder plugin 1.55.4 and earlier for | medium | 4.3 | 2% |
| CVE-2014-4571 | vn-calendar (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote att | medium | 4.3 | 2% |
| CVE-2014-4587 | wp-guestmap-project (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP GuestMap plugin 1.8 and earlier for WordPress allow remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4589 | wp-silverlight-media-player (WordPress plugin) | Cross-site scripting (XSS) vulnerability in uploader.php in the WP Silverlight Media Player (wp-media-player) plugin 0.8 and earlier for Wor | medium | 4.3 | 2% |
| CVE-2014-4596 | snapapp (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in js/button-snapapp.php in the SnapApp plugin 1.5 and earlier for WordPress allow remot | medium | 4.3 | 2% |
| CVE-2014-4845 | bannerman (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 2% |
| CVE-2014-4846 | metaslider (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary | medium | 4.3 | 2% |
| CVE-2014-4847 | random-banner (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2014-4848 | blogstand-smart-banner (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers t | medium | 4.3 | 2% |
| CVE-2014-4854 | wp-contruction-mode (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 2% |
| CVE-2014-9570 | simple-security (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow rem | medium | 4.3 | 2% |
| CVE-2014-7217 | phpmyadmin/phpmyadmin | phpMyAdmin cross-site scripting Vulnerability via ENUM value | low | 0.0 | 2% |
| CVE-2010-5097 | typo3/cms-frontend | TYPO3 Cross-site scripting (XSS) vulnerability in the click enlarge functionality | low | 0.0 | 2% |
| CVE-2012-1606 | typo3/cms | Typo3 Backend XSS Vulnerabilities | low | 0.0 | 2% |
| CVE-2019-16781 | WordPress core | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, whi | medium | 5.8 | 2% |
| CVE-2019-14789 | custom-404-pro (WordPress plugin) | The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter. | medium | 6.1 | 2% |
| CVE-2021-4084 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.1 | 2% |
| CVE-2019-9575 | quiz-master-next (WordPress plugin) | The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS. | medium | 6.1 | 2% |
| CVE-2013-2695 | wp-symposium (WordPress plugin) | Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium plugin before 13.04 for WordPress allows remote attackers to inje | medium | 4.3 | 2% |