Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-18492 | contact-form-to-db (WordPress plugin) | The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2013-4997 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple cross-site scripting (XSS) vulnerabilities | medium | 0.0 | 1% |
| CVE-2022-0257 | pimcore/pimcore | pimcore is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-0285 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 5.4 | 1% |
| CVE-2014-7830 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2018-0546 | wp-all-import (WordPress plugin) | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web s | medium | 6.1 | 1% |
| CVE-2018-0547 | wp-all-import (WordPress plugin) | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web s | medium | 6.1 | 1% |
| CVE-2014-9310 | wordpress-backup-to-dropbox (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress. | medium | 6.1 | 1% |
| CVE-2013-1833 | moodle/moodle | Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module | low | 0.0 | 1% |
| CVE-2011-3591 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple XSS Vulnerabilities After Inline Editing and Save | low | 0.0 | 1% |
| CVE-2011-3592 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple XSS Vulnerabilities | low | 0.0 | 1% |
| CVE-2012-4345 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page | low | 0.0 | 1% |
| CVE-2012-5339 | phpmyadmin/phpmyadmin | phpMyAdmin multiple cross-site scripting vulnerabilities | low | 0.0 | 1% |
| CVE-2014-3943 | typo3/cms | Typo3 XSS Vulnerabilities | low | 0.0 | 1% |
| CVE-2015-0212 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2015-0216 | moodle/moodle | Moodle does not set the RISK_XSS bit for graders | low | 0.0 | 1% |
| CVE-2015-2273 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2015-3174 | moodle/moodle | Moodle does not set the RISK_XSS bit for graders | low | 0.0 | 1% |
| CVE-2015-3178 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2022-0206 | newstatpress (WordPress plugin) | The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, lead | medium | 6.1 | 1% |
| CVE-2021-25104 | ocean-extra (WordPress plugin) | The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a R | medium | 6.1 | 1% |
| CVE-2021-20746 | wordpress-popular-posts (WordPress plugin) | Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrar | medium | 5.4 | 1% |
| CVE-2017-18532 | realty (WordPress plugin) | The realty plugin before 1.1.0 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2021-24940 | persian-woocommerce (WordPress plugin) | The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admi | medium | 6.1 | 1% |
| CVE-2022-0599 | mapping-multiple-urls-redirect-same-page (WordPress plugin) | The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before output | medium | 6.1 | 1% |
| CVE-2021-24876 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attr | medium | 6.1 | 1% |
| CVE-2022-0509 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 5.4 | 1% |
| CVE-2020-11030 | WordPress core | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the | medium | 6.4 | 1% |
| CVE-2022-1910 | shortcodes-and-extra-features-for-phlox-theme (WordPress plugin) | The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back | medium | 6.1 | 1% |
| CVE-2018-0576 | events-manager (WordPress plugin) | Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary w | medium | 5.4 | 1% |
| CVE-2014-7835 | moodle/moodle | Moodle allows attackers to upload files containing JavaScript | low | 0.0 | 1% |
| CVE-2017-2216 | download-manager (WordPress plugin) | Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web scr | medium | 6.1 | 1% |
| CVE-2018-5288 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page. | medium | 6.1 | 1% |
| CVE-2020-29653 | froxlor/froxlor | HTML Injection in Froxlor | medium | 6.1 | 1% |
| CVE-2020-13278 | francoisjacquet/rosariosis | Reflected cross-site scripting in francoisjacquet/rosariosis | medium | 6.1 | 1% |
| CVE-2012-5181 | concrete5/concrete5 | Concrete5 Vulnerable to Cross-Site Scripting (XSS) | medium | 0.0 | 1% |
| CVE-2020-9665 | magento/core | Magento stored cross-site scripting vulnerability | medium | 6.1 | 1% |
| CVE-2020-10196 | popup-builder (WordPress plugin) | An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into exi | medium | 6.1 | 1% |
| CVE-2019-9908 | font-organizer (WordPress plugin) | The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS. | medium | 6.1 | 1% |
| CVE-2019-9909 | givewp (WordPress plugin) | The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. | medium | 6.1 | 1% |
| CVE-2022-2599 | anti-malware-security-and-brute-force-firewall (WordPress plugin) | The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outpu | medium | 6.1 | 1% |
| CVE-2016-10990 | wp-cerber (WordPress plugin) | The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header. | medium | 6.1 | 1% |
| CVE-2018-19993 | dolibarr/dolibarr | Dolibarr reflected cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-24807 | support-board (WordPress plugin) | The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a pay | medium | 5.4 | 1% |
| CVE-2022-0268 | getgrav/grav | Cross-site Scripting in grav | medium | 5.7 | 1% |
| CVE-2015-5484 | wp-plotly (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitra | medium | 5.4 | 1% |
| CVE-2022-2170 | microsoft-advertising-universal-event-tracking (WordPress plugin) | The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing h | medium | 4.8 | 1% |
| CVE-2017-18500 | social-buttons-pack (WordPress plugin) | The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18501 | social-login-bws (WordPress plugin) | The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2018-1081 | moodle/moodle | Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script | medium | 5.3 | 1% |