Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-7104 | chained-quiz (WordPress plugin) | The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter. | medium | 6.1 | 2% |
| CVE-2017-6927 | drupal/core, drupal/drupal | Drupal cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2021-21023 | magento/community-edition, magento/project-community-edition | Magento stored cross-site scripting vulnerability in the admin console | medium | 4.8 | 2% |
| CVE-2014-4986 | phpmyadmin/phpmyadmin | phpMyAdmin cross-site scripting Vulnerability in Table or Column Names | low | 0.0 | 2% |
| CVE-2021-24239 | pie-register (WordPress plugin) | The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not | medium | 6.1 | 2% |
| CVE-2018-7260 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature | medium | 5.4 | 2% |
| CVE-2013-6280 | social-sharing-toolkit (WordPress plugin) | Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbit | medium | 4.3 | 2% |
| CVE-2013-3263 | wp-ultimate-email-marketer-plugin (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow | medium | 4.3 | 2% |
| CVE-2014-9443 | relevanssi (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web | medium | 4.3 | 2% |
| CVE-2018-18478 | librenms/librenms | LibreNMS XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2024-1234 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up t | medium | 6.4 | 2% |
| CVE-2021-24454 | yop-poll (WordPress plugin) | In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the | medium | 6.1 | 2% |
| CVE-2020-13487 | bbpress (WordPress plugin), bbpress/bbpress | The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/e | medium | 4.8 | 2% |
| CVE-2019-17674 | WordPress core | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. | medium | 5.4 | 2% |
| CVE-2015-2195 | wp-media-cleaner (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbi | medium | 4.3 | 2% |
| CVE-2014-3123 | nextcellent-gallery-nextgen-legacy (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows re | low | 2.1 | 2% |
| CVE-2007-1732 | WordPress core | Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators | low | 3.5 | 2% |
| CVE-2018-19917 | microweber/microweber | Microweber XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2021-24657 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers su | medium | 6.1 | 2% |
| CVE-2021-45394 | spipu/html2pdf | Cross-site Scripting in HTML2PDF | high | 8.8 | 2% |
| CVE-2015-9539 | fast-secure-contact-form (WordPress plugin) | The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS. | medium | 6.1 | 2% |
| CVE-2014-4855 | polylang (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2014-4856 | polldaddy (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inje | medium | 4.3 | 2% |
| CVE-2015-9230 | bulletproof-security (WordPress plugin) | In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible f | medium | 4.8 | 2% |
| CVE-2021-41165 | ckeditor/ckeditor | HTML comments vulnerability allowing to execute JavaScript code | high | 8.2 | 2% |
| CVE-2022-0148 | mystickyelements (WordPress plugin) | The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on | medium | 5.4 | 2% |
| CVE-2014-5344 | mobiloud-mobile-app-plugin (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow rem | medium | 4.3 | 2% |
| CVE-2014-6445 | contact-form-7-integrations (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for Wor | medium | 4.3 | 2% |
| CVE-2016-0725 | moodle/moodle | Moodle Cross-site scripting (XSS) vulnerability in course management search | medium | 6.1 | 2% |
| CVE-2015-4337 | xcloner (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web | low | 3.5 | 2% |
| CVE-2017-18011 | affiliate-ads-for-clickbank-products (WordPress plugin) | The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter | medium | 6.1 | 2% |
| CVE-2022-0147 | wp-gdpr-compliance (WordPress plugin) | The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in att | medium | 6.1 | 2% |
| CVE-2021-20750 | ec-cube/ec-cube | EC-CUBE Cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2015-4139 | wp-smiley (WordPress plugin) | Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to | low | 3.5 | 2% |
| CVE-2024-7313 | shield-security (WordPress plugin) | The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 2% |
| CVE-2014-8622 | compfight (WordPress plugin) | Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users | low | 3.5 | 2% |
| CVE-2018-13983 | impresscms/impresscms | ImpressCMS XSS | medium | 6.1 | 2% |
| CVE-2015-9453 | broken-link-manager (WordPress plugin) | The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist. | medium | 6.1 | 2% |
| CVE-2021-24522 | profilepress (WordPress plugin) | The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for | medium | 6.1 | 2% |
| CVE-2014-5202 | compfight (WordPress plugin) | Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users | low | 3.5 | 2% |
| CVE-2022-0262 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.6 | 2% |
| CVE-2022-1173 | getgrav/grav | Stored cross site scripting in getgrav/grav | medium | 5.4 | 2% |
| CVE-2009-3629 | typo3/cms-backend | TYPO3 Backend vulnerable to Cross-site Scripting | low | 0.0 | 2% |
| CVE-2016-9188 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2019-16126 | getgrav/grav | Cross-site Scripting in Grav | medium | 6.1 | 2% |
| CVE-2015-8606 | silverstripe/cms | Silverstripe CMS XSS Vulnerability | medium | 6.1 | 2% |
| CVE-2014-8326 | phpmyadmin/phpmyadmin | phpMyAdmin Implementation XSS Vulnerability on Server Monitor Page | medium | 0.0 | 2% |
| CVE-2019-16217 | WordPress core | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | medium | 6.1 | 2% |
| CVE-2022-0230 | bwp-google-xml-sitemaps (WordPress plugin) | The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the ad | medium | 6.1 | 2% |
| CVE-2019-16520 | all-in-one-seo-pack (WordPress plugin) | The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of | medium | 5.4 | 2% |