Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-55416 | tcg/voyager | DevDojo Voyager vulnerable to reflected Cross-site Scripting | low | 0.0 | 20% |
| CVE-2023-4372 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and includi | medium | 6.4 | 20% |
| CVE-2021-24275 | popup (WordPress plugin) | The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attr | medium | 6.1 | 18% |
| CVE-2021-24274 | ultimate-maps (WordPress plugin) | The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in | medium | 6.1 | 18% |
| CVE-2022-4971 | sassy-social-share (WordPress plugin) | The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor | medium | 6.1 | 17% |
| CVE-2025-55296 | librenms/librenms | LibreNMS allows stored XSS in Alert Template name field | medium | 5.5 | 17% |
| CVE-2015-3440 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web | medium | 4.3 | 17% |
| CVE-2024-6931 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and inc | high | 7.2 | 17% |
| CVE-2019-8331 | twbs/bootstrap | Bootstrap Vulnerable to Cross-Site Scripting | medium | 6.1 | 16% |
| CVE-2021-24276 | contact-form (WordPress plugin) | The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in | medium | 6.1 | 16% |
| CVE-2024-6651 | wordpress-file-upload (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.1 | 16% |
| CVE-2022-35698 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Stored Cross-Site Scripting (Stored XSS) | critical | 10.0 | 15% |
| CVE-2021-24291 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting ( | medium | 6.1 | 15% |
| CVE-2015-2068 | dweeves/magmi | MAGMI cross-site scripting (XSS) | medium | 0.0 | 14% |
| CVE-2019-3810 | moodle/moodle | Moodle XSS Vulnerability | medium | 5.3 | 14% |
| CVE-2022-0595 | drag-and-drop-multiple-file-upload---contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_uplo | medium | 5.4 | 14% |
| CVE-2018-18069 | wpml (WordPress plugin) | process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (s | medium | 6.1 | 13% |
| CVE-2020-29395 | eventon (WordPress plugin) | The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. | medium | 6.1 | 13% |
| CVE-2021-24926 | domain-check (WordPress plugin) | The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, lea | medium | 6.1 | 13% |
| CVE-2025-62411 | librenms/librenms | LibreNMS has a Stored XSS vulnerability in its Alert Transport name field | medium | 5.5 | 13% |
| CVE-2021-24286 | redirect-404-to-parent (WordPress plugin) | The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting | medium | 6.1 | 13% |
| CVE-2019-6341 | drupal/core, drupal/drupal | Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross- | medium | 5.4 | 12% |
| CVE-2024-34051 | dolibarr/dolibarr | Reflected Cross-Site Scripting (XSS) in Dolibarr | medium | 0.0 | 12% |
| CVE-2019-15889 | download-manager (WordPress plugin) | The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search | medium | 6.1 | 11% |
| CVE-2021-24488 | post-grid (WordPress plugin) | The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before | medium | 6.1 | 11% |
| CVE-2024-6497 | squirrly-seo (WordPress plugin) | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up | high | 8.8 | 11% |
| CVE-2021-24320 | bello (WordPress plugin) | The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field | medium | 6.1 | 11% |
| CVE-2021-24300 | product-slider-for-woocommerce (WordPress plugin) | The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitise | medium | 6.1 | 11% |
| CVE-2008-1502 | moodle/moodle | Moodle vulnerable to Cross-site scripting | medium | 0.0 | 11% |
| CVE-2012-4768 | download-monitor (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbit | medium | 4.3 | 10% |
| CVE-2021-24287 | select-all-categories-and-taxonomies\,-change-checkbox-to-radio-buttons (WordPress plugin) | The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not proper | medium | 6.1 | 10% |
| CVE-2021-24169 | advanced-order-export-for-woocommerce (WordPress plugin) | This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab paramete | medium | 6.1 | 10% |
| CVE-2025-47931 | librenms/librenms | LibreNMS stored Cross-site Scripting vulnerability in poller group name | low | 0.0 | 10% |
| CVE-2021-29625 | vrana/adminer | XSS in doc_link | high | 7.5 | 10% |
| CVE-2019-6112 | sell-media (WordPress plugin) | A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to | medium | 6.1 | 9% |
| CVE-2012-3414 | WordPress core | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image | medium | 4.3 | 9% |
| CVE-2018-19287 | ninja-forms (WordPress plugin) | XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss | medium | 6.1 | 9% |
| CVE-2014-9094 | video-gallery (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for | medium | 4.3 | 9% |
| CVE-2022-3766 | thorsten/phpmyfaq | phpMyFAQ vulnerable to reflected Cross-site Scripting | medium | 6.1 | 8% |
| CVE-2017-7391 | dweeves/magmi | Magmi XSS Vulnerability | medium | 6.1 | 8% |
| CVE-2022-0422 | white-label-cms (WordPress plugin) | The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it | medium | 6.1 | 8% |
| CVE-2022-23808 | phpmyadmin/phpmyadmin | Cross-site Scripting in phpmyadmin | medium | 6.1 | 8% |
| CVE-2009-2851 | WordPress core | Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrar | medium | 4.3 | 8% |
| CVE-2015-4127 | church-admin (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary w | medium | 4.3 | 7% |
| CVE-2022-0864 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before ou | medium | 6.1 | 7% |
| CVE-2015-3438 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attacker | medium | 4.3 | 7% |
| CVE-2016-4567 | WordPress core, contao-components/mediaelement, contao/core | Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, | medium | 6.1 | 7% |
| CVE-2015-2807 | navis-documentcloud (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attacke | medium | 4.3 | 7% |
| CVE-2022-2941 | wp-useronline (WordPress plugin) | The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. Thi | medium | 5.5 | 7% |
| CVE-2011-4624 | grand-flagallery (WordPress plugin) | Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allo | medium | 4.3 | 7% |