Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0968 | watu (WordPress plugin) | The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dn’, 'email', 'points', and 'date' parameters in | medium | 6.1 | 1% |
| CVE-2013-4693 | digital-flash-clock (WordPress plugin) | WordPress Xorbin Digital Flash Clock 1.0 has XSS | medium | 6.1 | 1% |
| CVE-2011-4782 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2019-12517 | slickquiz (WordPress plugin) | An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-a | medium | 6.1 | 1% |
| CVE-2021-39170 | pimcore/pimcore | Improper Encoding or Escaping of Output in Asset Metadata Component | high | 8.0 | 1% |
| CVE-2017-6099 | paypal/merchant-sdk-php | PayPal PHP Merchant SDK Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2024-1247 | concrete5/concrete5 | Concrete CMS vulnerable to stored XSS via the Role Name field | low | 2.0 | 1% |
| CVE-2019-14315 | sunhater/kcfinder | SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php | medium | 6.1 | 1% |
| CVE-2021-24429 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointmen | medium | 6.1 | 1% |
| CVE-2015-7386 | gallery---photo-albums---portfolio (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for Wo | low | 3.5 | 1% |
| CVE-2017-6216 | novaksolutions/infusionsoft-php-sdk | infusionsoft-php-sdk reflected Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2017-6217 | paypal/adaptivepayments-sdk-php | paypal/adaptivepayments-sdk-php vulnerable to a reflected XSS | medium | 6.1 | 1% |
| CVE-2012-3522 | geshi/geshi | GeSHi vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2019-16523 | events-manager (WordPress plugin) | The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and inserti | medium | 5.4 | 1% |
| CVE-2021-24964 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attack | medium | 6.1 | 1% |
| CVE-2024-11605 | wp-publications (WordPress plugin) | The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high p | medium | 4.8 | 1% |
| CVE-2021-24304 | newsmag (WordPress plugin) | The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthent | medium | 6.1 | 1% |
| CVE-2017-12156 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2021-24994 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise | medium | 6.1 | 1% |
| CVE-2019-3808 | moodle/moodle | Moodle XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2016-10941 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF. | medium | 6.1 | 1% |
| CVE-2020-15178 | prestashop/contactform | Potential XSS injection In PrestaShop contactform | high | 8.0 | 1% |
| CVE-2019-7881 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2024-0509 | wp-404-auto-redirect-to-similar-post (WordPress plugin) | The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in | medium | 6.1 | 1% |
| CVE-2017-6929 | drupal/core, drupal/drupal | Drupal cross site scripting vulnerability | medium | 6.1 | 1% |
| CVE-2021-36873 | iq-block-country (WordPress plugin) | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable para | medium | 5.5 | 1% |
| CVE-2014-8492 | profile-builder (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPres | medium | 6.1 | 1% |
| CVE-2023-0942 | woocommerce-for-japan (WordPress plugin) | The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to | medium | 6.1 | 1% |
| CVE-2018-17884 | gwolle-gb (WordPress plugin) | XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-ad | medium | 6.1 | 1% |
| CVE-2018-17947 | snazzy-maps (WordPress plugin) | The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter. | medium | 6.1 | 1% |
| CVE-2015-9537 | nextgen-gallery (WordPress plugin) | The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thum | medium | 5.4 | 1% |
| CVE-2019-14950 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. | medium | 6.1 | 1% |
| CVE-2020-8498 | gistpress (WordPress plugin) | XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id paramet | medium | 5.4 | 1% |
| CVE-2006-4067 | cakephp/cakephp | Cross-site scripting (XSS) vulnerability in CakePHP | medium | 6.5 | 1% |
| CVE-2021-24991 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting | medium | 4.8 | 1% |
| CVE-2011-2714 | drupal/core | Drupal Cross-Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-1091 | darylldoyle/safe-svg, safe-svg (WordPress plugin) | Cross site scripting in safe-svg | medium | 6.1 | 1% |
| CVE-2020-8594 | ninja-forms (WordPress plugin) | The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptc | medium | 5.4 | 1% |
| CVE-2017-18121 | simplesamlphp/simplesamlphp | SimpleSAMLphp XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2019-15317 | give (WordPress plugin) | The give plugin before 2.4.7 for WordPress has XSS via a donor name. | medium | 5.4 | 1% |
| CVE-2019-19198 | scoutnet-kalender (WordPress plugin) | The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS. | medium | 5.4 | 1% |
| CVE-2014-4567 | video-comments-webcam-recorder (WordPress plugin) | Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downlo | medium | 6.1 | 1% |
| CVE-2017-13138 | bridge (WordPress theme) | DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary | medium | 6.1 | 1% |
| CVE-2014-4932 | wordfence-security (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbit | medium | 6.1 | 1% |
| CVE-2021-24305 | watcheezy (WordPress plugin) | The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability | medium | 6.1 | 1% |
| CVE-2022-32060 | snipe/snipe-it | Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings | medium | 4.8 | 1% |
| CVE-2018-13137 | events-manager (WordPress plugin) | The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type= | medium | 4.8 | 1% |
| CVE-2011-4299 | moodle/moodle | Moodle vulnerable to Cross-Site Scripting | low | 0.0 | 1% |
| CVE-2013-4941 | moodle/moodle | YUI Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 1% |
| CVE-2013-4942 | moodle/moodle | YUI Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 1% |