Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24834 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Opti | medium | 5.4 | 2% |
| CVE-2021-42112 | limesurvey/limesurvey | Cross-site Scripting in Limesurvey | medium | 6.1 | 2% |
| CVE-2008-0618 | dmsguestbook (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allow remote attackers to injec | medium | 4.3 | 2% |
| CVE-2020-11025 | WordPress core | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code | medium | 5.8 | 2% |
| CVE-2016-10893 | crayon-syntax-highlighter (WordPress plugin) | The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests. | medium | 6.1 | 2% |
| CVE-2013-2008 | wp-super-cache (WordPress plugin) | WordPress Super Cache Plugin 1.3 has XSS. | medium | 6.1 | 2% |
| CVE-2021-25107 | form-store-to-db (WordPress plugin) | The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entr | medium | 6.1 | 2% |
| CVE-2015-7667 | resads (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in th | medium | 6.1 | 2% |
| CVE-2016-4812 | markdown-on-save-improved (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to injec | medium | 6.1 | 2% |
| CVE-2018-13055 | mantisbt/mantisbt | MantisBT allows XSS via View Filters page | medium | 6.1 | 2% |
| CVE-2016-10976 | safe-editor (WordPress plugin) | The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS. | medium | 6.1 | 2% |
| CVE-2020-9577 | magento/community-edition, magento/core, magento/project-community-edition | Magento stored cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2020-9581 | magento/community-edition, magento/core, magento/project-community-edition | Magento stored cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2020-29171 | all-in-one-wp-security-and-firewall (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall | medium | 6.1 | 1% |
| CVE-2021-39201 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The iss | high | 7.6 | 1% |
| CVE-2015-9405 | wp-piwik (WordPress plugin) | The wp-piwik plugin before 1.0.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2012-3531 | typo3/cms | Typo3 Install Tool XSS Vulnerability | medium | 0.0 | 1% |
| CVE-2013-4940 | moodle/moodle | YUI Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 1% |
| CVE-2016-1160 | wp-favorite-posts (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitr | medium | 6.1 | 1% |
| CVE-2016-4826 | welcart-e-commerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to injec | medium | 6.1 | 1% |
| CVE-2016-4827 | welcart-e-commerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to injec | medium | 6.1 | 1% |
| CVE-2020-25288 | mantisbt/mantisbt | MantisBT XXS where a Custom Field with a crafted Regular Expression property is used | medium | 4.8 | 1% |
| CVE-2014-3903 | cakifo (WordPress theme) | Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbi | low | 3.5 | 1% |
| CVE-2016-7571 | drupal/core, drupal/drupal | Drupal Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2015-5057 | broken-link-checker (WordPress plugin) | Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed. | medium | 6.1 | 1% |
| CVE-2022-2187 | contact-form-7-captcha (WordPress plugin) | The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in | medium | 6.1 | 1% |
| CVE-2013-5583 | joomla/joomla-cms | Joomla! Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2018-13136 | ultimate-member (WordPress plugin) | The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen. | medium | 6.1 | 1% |
| CVE-2022-1904 | easy-pricing-tables (WordPress plugin) | The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page | medium | 6.1 | 1% |
| CVE-2021-24956 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter b | medium | 6.1 | 1% |
| CVE-2019-8153 | magento/community-edition, magento/product-community-edition | Magento Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2007-6677 | random-anti-spam-image (WordPress plugin) | Cross-site scripting (XSS) vulnerability in Peter's Random Anti-Spam Image 0.2.4 and earlier plugin for WordPress allows remote attackers to | medium | 4.3 | 1% |
| CVE-2024-10793 | wp-security-audit-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and i | high | 7.2 | 1% |
| CVE-2020-7994 | dolibarr/dolibarr | Dolibarr cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2019-10905 | erusev/parsedown | Parsedown Class-Name Injection | high | 8.1 | 1% |
| CVE-2019-17231 | onetone (WordPress theme) | includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues. | medium | 6.1 | 1% |
| CVE-2016-9856 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2016-9857 | phpmyadmin/phpmyadmin | phpMyAdmin XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-18012 | z-url-preview (WordPress plugin) | The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter. | medium | 6.1 | 1% |
| CVE-2020-15721 | francoisjacquet/rosariosis | Cross-site Scripting in RosarioSIS | medium | 6.1 | 1% |
| CVE-2015-3274 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2015-3275 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | medium | 6.1 | 1% |
| CVE-2016-2152 | moodle/moodle | Moodle XSS from profile fields from external db | medium | 6.1 | 1% |
| CVE-2016-2153 | moodle/moodle | Moodle Reflected XSS in mod_data advanced search | medium | 6.1 | 1% |
| CVE-2023-39062 | spipu/html2pdf | Spipu HTML2PDF vulnerable to cross-site scripting | medium | 6.1 | 1% |
| CVE-2017-14313 | shibboleth (WordPress plugin) | The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due | medium | 6.1 | 1% |
| CVE-2017-18015 | share-this-image (WordPress plugin) | The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter. | medium | 6.1 | 1% |
| CVE-2017-18487 | adsense-plugin (WordPress plugin) | The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18490 | contact-form-multi (WordPress plugin) | The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18491 | contact-form-plugin (WordPress plugin) | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |