Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2013-7077 | typo3/cms-core | TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module | medium | 0.0 | 1% |
| CVE-2013-7082 | neos/flow, typo3/flow | TYPO3 Flow Cross-site scripting (XSS) vulnerability | medium | 0.0 | 1% |
| CVE-2014-3547 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | medium | 0.0 | 1% |
| CVE-2021-24294 | dsgvo-all-in-one-for-wp (WordPress plugin) | The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter | medium | 6.1 | 1% |
| CVE-2021-24792 | shiny-buttons (WordPress plugin) | The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_templa | medium | 6.1 | 1% |
| CVE-2021-24796 | my-tickets (WordPress plugin) | The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it i | medium | 6.1 | 1% |
| CVE-2021-24797 | tickera (WordPress plugin) | The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in | medium | 6.1 | 1% |
| CVE-2021-24967 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allo | medium | 6.1 | 1% |
| CVE-2022-2362 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, whi | high | 7.5 | 1% |
| CVE-2022-1985 | download-manager (WordPress plugin) | The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is d | medium | 6.1 | 1% |
| CVE-2018-6944 | ultimate-member (WordPress plugin) | core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails | medium | 6.1 | 1% |
| CVE-2015-9410 | powerpress (WordPress plugin) | The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter. | medium | 5.4 | 1% |
| CVE-2024-47605 | silverstripe/framework | Silverstripe Framework has a XSS via insert media remote file oembed | medium | 5.4 | 1% |
| CVE-2014-4525 | ebay-feeds-for-wordpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for Wo | medium | 6.1 | 1% |
| CVE-2014-6604 | subscribe2 (WordPress plugin) | Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attack | medium | 6.1 | 1% |
| CVE-2014-7240 | easy-contact-form-solution (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject | medium | 6.1 | 1% |
| CVE-2014-8758 | gallery-bank (WordPress plugin) | Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 1% |
| CVE-2019-15829 | photoblocks-grid-gallery (WordPress plugin) | The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. | medium | 4.8 | 1% |
| CVE-2023-23491 | quick-event-manager (WordPress plugin) | The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' p | medium | 6.1 | 1% |
| CVE-2020-16266 | mantisbt/mantisbt | MantisBT XSS issue on the view_all_bug_page.php | medium | 5.4 | 1% |
| CVE-2015-9403 | neuvoo-jobroll (WordPress plugin) | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. | medium | 6.1 | 1% |
| CVE-2015-9419 | captain-slider (WordPress plugin) | The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section. | medium | 6.1 | 1% |
| CVE-2016-11001 | user-submitted-posts (WordPress plugin) | The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. | medium | 6.1 | 1% |
| CVE-2012-6145 | typo3/cms | Typo3 Backend History Module Vulnerable to XSS | low | 0.0 | 1% |
| CVE-2012-6148 | typo3/cms | Typo3 Function Menu API XSS Vulnerability | low | 0.0 | 1% |
| CVE-2022-1567 | wp-js (WordPress plugin) | The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and ech | medium | 6.1 | 1% |
| CVE-2021-24234 | ivory-search (WordPress plugin) | The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the p | medium | 6.1 | 1% |
| CVE-2015-9392 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter. | medium | 5.4 | 1% |
| CVE-2020-14042 | codiad/codiad | Codiad Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2020-9584 | magento/community-edition, magento/core, magento/project-community-edition | Magento Stored cross-site scripting | medium | 5.4 | 1% |
| CVE-2015-5269 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2021-42363 | woo-preview-emails (WordPress plugin) | The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in | medium | 6.1 | 1% |
| CVE-2020-15535 | car-rental-system (WordPress plugin) | An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the regis | medium | 6.1 | 1% |
| CVE-2020-15536 | online-hotel-booking-system (WordPress plugin) | An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of th | medium | 6.1 | 1% |
| CVE-2020-15537 | vanguard (WordPress plugin) | An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI | medium | 6.1 | 1% |
| CVE-2019-12345 | hostel (WordPress plugin) | XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress. | medium | 6.1 | 1% |
| CVE-2019-15539 | mantisbt/mantisbt | MantisBT XSS when uploading an attachment | medium | 6.1 | 1% |
| CVE-2022-0879 | caldera-forms (WordPress plugin) | The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, | medium | 6.1 | 1% |
| CVE-2024-21911 | tinymce/tinymce | Cross-site scripting vulnerability in TinyMCE | medium | 0.0 | 1% |
| CVE-2014-4519 | conversador (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrar | medium | 6.1 | 1% |
| CVE-2014-4523 | easy-career-openings (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject | medium | 6.1 | 1% |
| CVE-2014-4548 | ruven-toolkit (WordPress plugin) | Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attack | medium | 6.1 | 1% |
| CVE-2014-4553 | spreadshirt-rss-3d-cube-flash-gallery (WordPress plugin) | Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitra | medium | 6.1 | 1% |
| CVE-2014-4559 | swipehq-payment-gateway-wp-e-commerce (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for | medium | 6.1 | 1% |
| CVE-2022-1906 | copyright-proof (WordPress plugin) | The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action avai | medium | 6.1 | 1% |
| CVE-2023-25727 | phpmyadmin/phpmyadmin | Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin | medium | 5.4 | 1% |
| CVE-2011-1940 | phpmyadmin/phpmyadmin | phpMyAdmin Vulnerable to Cross-Site Scripting | low | 0.0 | 1% |
| CVE-2020-15881 | munkireport/munki_facts | MunkiReport munki_facts module Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2020-15883 | munkireport/managedinstalls | MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2017-18609 | magic-fields (WordPress plugin) | The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter. | medium | 6.1 | 1% |