Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9472 | incoming-links (WordPress plugin) | The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header. | medium | 6.1 | 1% |
| CVE-2020-5392 | wp-auth0 (WordPress plugin) | A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page. | medium | 6.1 | 1% |
| CVE-2020-6753 | login-by-auth0 (WordPress plugin) | The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392. | medium | 6.1 | 1% |
| CVE-2020-7776 | phpoffice/phpexcel, phpoffice/phpspreadsheet | Cross-site scripting in phpoffice/phpspreadsheet | medium | 6.4 | 1% |
| CVE-2015-7672 | centreon/centreon | Centreon Cross-site Scripting Vulnerability | medium | 5.4 | 1% |
| CVE-2023-25313 | wwbn/avideo | AVideo contains Command injection when embedding a video link | critical | 9.6 | 1% |
| CVE-2016-5705 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2018-20962 | backpack/crud | Backpack\CRUD for Laravel XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2024-20719 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Scripting (XSS) | critical | 9.1 | 1% |
| CVE-2019-17515 | cleantalk-spam-protect (WordPress plugin) | The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows a | medium | 6.1 | 1% |
| CVE-2022-1187 | wp-youtube-live (WordPress plugin) | The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which a | medium | 6.1 | 1% |
| CVE-2023-5546 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2017-14498 | silverstripe/cms | Silverstripe CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2018-18379 | elementor-page-builder (WordPress plugin) | The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2021-24350 | visitors-online (WordPress plugin) | The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin woul | medium | 6.1 | 1% |
| CVE-2025-23199 | librenms/librenms | LibreNMS Ports Stored Cross-site Scripting vulnerability | medium | 4.6 | 1% |
| CVE-2024-2242 | contact-form-7 (WordPress plugin) | The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to | medium | 6.1 | 1% |
| CVE-2022-0704 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2019-14797 | photo-gallery (WordPress plugin) | The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS. | medium | 5.4 | 1% |
| CVE-2015-3421 | eshop (WordPress plugin) | The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" | medium | 6.1 | 1% |
| CVE-2020-25702 | moodle/moodle | Cross-site Scripting (XSS) in moodle | medium | 6.1 | 1% |
| CVE-2022-1051 | wpqa-builder (WordPress plugin) | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the c | medium | 5.4 | 1% |
| CVE-2020-8426 | elementor (WordPress plugin) | The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be e | medium | 5.4 | 1% |
| CVE-2022-0831 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2020-15155 | baserproject/basercms | Cross Site Scripting(XSS) Vulnerability in Latest Release 4.3.6 Site basic settings | high | 7.3 | 1% |
| CVE-2019-12471 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-0899 | header-footer-code-manager (WordPress plugin) | The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an | medium | 6.1 | 1% |
| CVE-2012-1296 | elefant/cms | Elefant CMS Multiple XSS Vulnerabilities | medium | 0.0 | 1% |
| CVE-2013-5100 | jambagecom/div2007 | Static Methods since 2007 (div2007) extension for TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2013-5323 | sjbr/static-info-tables | Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2021-24693 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, | critical | 9.0 | 1% |
| CVE-2023-38888 | dolibarr/dolibarr | Cross Site Scripting vulnerability in Dolibarr ERP CRM | critical | 9.6 | 1% |
| CVE-2016-6608 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2017-14751 | wp-jobs (WordPress plugin) | The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field. | medium | 6.1 | 1% |
| CVE-2010-3659 | typo3/cms-backend | TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms | medium | 5.4 | 1% |
| CVE-2015-6535 | youtube-embed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remo | low | 3.5 | 1% |
| CVE-2020-29471 | opencart/opencart | OpenCart Stored Cross-Site Scripting | medium | 4.8 | 1% |
| CVE-2021-20280 | moodle/moodle | Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle | medium | 5.4 | 1% |
| CVE-2018-5286 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page. | medium | 6.1 | 1% |
| CVE-2018-5292 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page. | medium | 6.1 | 1% |
| CVE-2018-5293 | gd-rating-system (WordPress plugin) | The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page. | medium | 6.1 | 1% |
| CVE-2022-30999 | fof/upload | Possible cross-site scripting attack via unsanitized SVG files in FoF Upload | high | 8.7 | 1% |
| CVE-2022-0535 | e2pdf (WordPress plugin) | The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2023-1080 | gn-publisher (WordPress plugin) | The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and includi | medium | 6.1 | 1% |
| CVE-2021-3985 | kevinpapst/kimai2 | kimai2 is vulnerable to Cross-site Scripting | high | 8.0 | 1% |
| CVE-2022-43497 | WordPress core | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scri | medium | 6.1 | 1% |
| CVE-2018-14430 | multi-step-form (WordPress plugin) | The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data | medium | 6.1 | 1% |
| CVE-2022-1555 | microweber/microweber | Microweber vulnerable to cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2019-9911 | social-networks-auto-poster (WordPress plugin) | The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edi | medium | 6.1 | 1% |
| CVE-2016-10994 | truemag-theme (WordPress theme) | The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter. | medium | 6.1 | 1% |