Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-14063 | tc-custom-javascript (WordPress plugin) | A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remot | medium | 6.1 | 1% |
| CVE-2015-9420 | soundcloud-is-gold (WordPress plugin) | The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter. | medium | 6.1 | 1% |
| CVE-2015-9430 | crazy-bone (WordPress plugin) | The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header. | medium | 6.1 | 1% |
| CVE-2016-10984 | echosign (WordPress plugin) | The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. | medium | 6.1 | 1% |
| CVE-2016-10985 | echosign (WordPress plugin) | The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. | medium | 6.1 | 1% |
| CVE-2016-10986 | tweet-wheel (WordPress plugin) | The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret. | medium | 6.1 | 1% |
| CVE-2016-10987 | persian-woocommerce-sms (WordPress plugin) | The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS. | medium | 6.1 | 1% |
| CVE-2016-10988 | leenkme (WordPress plugin) | The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description | medium | 6.1 | 1% |
| CVE-2018-17583 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action. | medium | 6.1 | 1% |
| CVE-2018-17585 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLangua | medium | 6.1 | 1% |
| CVE-2018-17586 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action. | medium | 6.1 | 1% |
| CVE-2019-6267 | easy-redirect-manager (WordPress plugin) | The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log vie | medium | 6.1 | 1% |
| CVE-2019-17229 | motors-car-dealership-classified-listings (WordPress plugin) | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for Wo | medium | 6.1 | 1% |
| CVE-2022-0743 | getgrav/grav | Cross site scripting in getgrav/grav | medium | 4.6 | 1% |
| CVE-2022-24833 | privatebin/privatebin | Persistent Cross-site Scripting vulnerability in PrivateBin | high | 8.2 | 1% |
| CVE-2020-9335 | photo-gallery (WordPress plugin) | Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnera | medium | 4.8 | 1% |
| CVE-2019-25152 | abandoned-cart-lite-for-woocommerce (WordPress plugin), abandoned-cart-pro-for-woocommerce (WordPress plugin) | The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scr | high | 7.2 | 1% |
| CVE-2017-15810 | popcashnet-code-integration-tool (WordPress plugin) | The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php. | medium | 6.1 | 1% |
| CVE-2017-6102 | rockhoist-badges-plugin (WordPress plugin) | Persistent XSS in wordpress plugin rockhoist-badges v1.2.2. | medium | 6.1 | 1% |
| CVE-2020-8436 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter. | medium | 6.1 | 1% |
| CVE-2022-3904 | monsterinsights (WordPress plugin) | The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauth | medium | 6.1 | 1% |
| CVE-2020-25814 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2012-5368 | phpmyadmin/phpmyadmin | phpMyAdmin Unsafe Fetching of Javascript Code | medium | 0.0 | 1% |
| CVE-2022-2473 | wp-useronline (WordPress plugin) | The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in ver | medium | 5.5 | 1% |
| CVE-2018-16285 | userpro (WordPress plugin) | The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/ad | medium | 6.1 | 1% |
| CVE-2021-24878 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wp | medium | 6.1 | 1% |
| CVE-2017-16842 | wordpress-seo (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPre | medium | 4.8 | 1% |
| CVE-2021-24556 | email-subscriber (WordPress plugin) | The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and e | medium | 6.1 | 1% |
| CVE-2019-12934 | wp-code-highlightjs (WordPress plugin) | An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-j | high | 8.8 | 1% |
| CVE-2021-24508 | smash-balloon-social-post-feed (WordPress plugin) | The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator | medium | 6.1 | 1% |
| CVE-2021-24756 | wp-system-log (WordPress plugin) | The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before | medium | 6.1 | 1% |
| CVE-2020-36731 | flexible-checkout-fields (WordPress plugin) | The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in add | high | 7.2 | 1% |
| CVE-2016-15041 | mainwp-dashboard (WordPress plugin) | The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Sit | high | 7.2 | 1% |
| CVE-2019-17550 | blog2social (WordPress plugin) | The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute a | medium | 6.1 | 1% |
| CVE-2022-0429 | wp-cerber-security\,-anti-spam-\&-malware-scan (WordPress plugin) | The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an att | medium | 6.1 | 1% |
| CVE-2021-24973 | site-reviews (WordPress plugin) | The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (avai | medium | 6.1 | 1% |
| CVE-2021-24975 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting t | medium | 6.1 | 1% |
| CVE-2015-9404 | neuvoo-jobroll (WordPress plugin) | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. | medium | 6.1 | 1% |
| CVE-2021-36787 | in2code/femanager | Cross-site Scripting in the femanager TYPO3 extension | medium | 0.0 | 1% |
| CVE-2021-34638 | download-manager (WordPress plugin) | Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive conf | medium | 6.5 | 1% |
| CVE-2015-9273 | slimstat-analytics (WordPress plugin) | The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated w | medium | 6.1 | 1% |
| CVE-2019-14364 | email-subscribers (WordPress plugin) | An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript c | medium | 6.1 | 1% |
| CVE-2022-2627 | newspaper (WordPress plugin) | The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, lea | medium | 6.1 | 1% |
| CVE-2018-9864 | wp-live-chat-support (WordPress plugin) | The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field. | medium | 6.1 | 1% |
| CVE-2021-30134 | php-mod/curl | php-mod/curl allows Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2017-9420 | spiffy-calendar (WordPress plugin) | Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 1% |
| CVE-2018-1000826 | microweber/microweber | Microweber XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2019-9567 | forminator (WordPress plugin) | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll. | medium | 6.1 | 1% |
| CVE-2021-25086 | advanced-page-visit-counter (WordPress plugin) | The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashb | medium | 6.1 | 1% |
| CVE-2015-9391 | yawpp (WordPress plugin) | The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter. | medium | 6.1 | 1% |