Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-9576 | blog2social (WordPress plugin) | The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. | medium | 6.1 | 1% |
| CVE-2021-24765 | perfect-survey (WordPress plugin) | The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the | medium | 6.1 | 1% |
| CVE-2021-36027 | magento/community-edition, magento/project-community-edition | Magento stored cross-site scripting vulnerability | medium | 0.0 | 1% |
| CVE-2017-18590 | timesheet (WordPress plugin) | The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2022-3869 | froxlor/froxlor | Froxlor vulnerable to code injection | medium | 6.1 | 1% |
| CVE-2017-18493 | custom-admin-page (WordPress plugin) | The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18494 | custom-search-plugin (WordPress plugin) | The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18496 | htaccess (WordPress plugin) | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2022-28290 | wordpress-country-selector (WordPress plugin) | Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user | medium | 6.1 | 1% |
| CVE-2010-5294 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPres | medium | 4.3 | 1% |
| CVE-2021-28556 | magento/community-edition, magento/project-community-edition | Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies | medium | 6.9 | 1% |
| CVE-2021-24934 | visual-css-style-editor (WordPress plugin) | The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back | medium | 6.1 | 1% |
| CVE-2022-0385 | crazy-bone (WordPress plugin) | The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them ba | medium | 6.1 | 1% |
| CVE-2019-16521 | broken-link-checker (WordPress plugin) | The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encodi | medium | 6.1 | 1% |
| CVE-2013-4744 | oliverklee/phpunit | PHPUnit extension for TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2016-10952 | quotes-collection (WordPress plugin) | The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter. | medium | 6.1 | 1% |
| CVE-2019-10864 | wp-statistics (WordPress plugin) | The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Ref | medium | 6.1 | 1% |
| CVE-2017-18564 | sender (WordPress plugin) | The sender plugin before 1.2.1 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18565 | updater (WordPress plugin) | The updater plugin before 1.35 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18566 | user-role (WordPress plugin) | The user-role plugin before 1.5.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2019-14791 | appointment-booking-calendar (WordPress plugin) | The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. | medium | 6.1 | 1% |
| CVE-2019-9646 | contact-form-to-email (WordPress plugin) | The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the | medium | 6.1 | 1% |
| CVE-2019-9910 | kingcomposer (WordPress plugin) | The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS. | medium | 6.1 | 1% |
| CVE-2017-18542 | zendesk-help-center (WordPress plugin) | The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2021-24241 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attri | medium | 6.1 | 1% |
| CVE-2022-2168 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history | medium | 6.1 | 1% |
| CVE-2012-2112 | typo3/cms | Typo3 Exception Handler XSS | medium | 0.0 | 1% |
| CVE-2016-1912 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerabilities | medium | 5.4 | 1% |
| CVE-2017-18530 | rating-bws (WordPress plugin) | The rating-bws plugin before 0.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18556 | bws-google-analytics (WordPress plugin) | The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18557 | bws-google-maps (WordPress plugin) | The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18558 | bws-testimonials (WordPress plugin) | The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18562 | error-log-viewer (WordPress plugin) | The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2022-32115 | idno/known | Known vulnerable to code execution via SVG file in v1.3.1 | medium | 6.1 | 1% |
| CVE-2022-25306 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parame | high | 7.2 | 1% |
| CVE-2022-25307 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform param | high | 7.2 | 1% |
| CVE-2018-16363 | file-manager (WordPress plugin) | The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request | medium | 5.4 | 1% |
| CVE-2018-16967 | wp-file-manager (WordPress plugin) | There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parame | medium | 6.1 | 1% |
| CVE-2019-14790 | limb-gallery (WordPress plugin) | The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=short | medium | 6.1 | 1% |
| CVE-2019-9913 | live-chat (WordPress plugin) | The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS. | medium | 6.1 | 1% |
| CVE-2022-0282 | microweber/microweber | Code Injection in microweber | high | 7.5 | 1% |
| CVE-2019-13505 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. | medium | 6.1 | 1% |
| CVE-2020-6850 | miniorange-saml-20-single-sign-on (WordPress plugin) | Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-l | medium | 6.1 | 1% |
| CVE-2020-35942 | nextgen-gallery (WordPress plugin) | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusi | high | 8.8 | 1% |
| CVE-2025-0924 | wp-security-audit-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and | high | 7.2 | 1% |
| CVE-2020-10803 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection vulnerability | medium | 5.4 | 1% |
| CVE-2015-1000004 | filedownload (WordPress plugin) | XSS in filedownload v1.4 wordpress plugin | medium | 6.1 | 1% |
| CVE-2020-7239 | conversation-watson (WordPress plugin) | The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing | medium | 6.1 | 1% |
| CVE-2010-3094 | drupal/drupal | Drupal cross-site scripting vulnerability via actions feature and trigger module | low | 0.0 | 1% |
| CVE-2021-24213 | givewp (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulner | medium | 6.1 | 1% |