Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-18610 | magic-fields (WordPress plugin) | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter. | medium | 6.1 | 1% |
| CVE-2017-18611 | magic-fields (WordPress plugin) | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter. | medium | 6.1 | 1% |
| CVE-2018-1000162 | erusev/parsedown | Cross-site Scripting in Parsedown | medium | 6.1 | 1% |
| CVE-2021-25022 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id paramet | medium | 6.1 | 1% |
| CVE-2018-19311 | centreon/centreon | Centreon XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2015-9412 | royal-slider (WordPress plugin) | The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter. | medium | 6.1 | 1% |
| CVE-2013-4714 | tikiwiki/tiki-manager | Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability | medium | 4.7 | 1% |
| CVE-2024-33297 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 0.0 | 1% |
| CVE-2024-33299 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 0.0 | 1% |
| CVE-2014-7151 | nex-forms-lite (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitr | medium | 6.1 | 1% |
| CVE-2019-17213 | webarx (WordPress plugin) | The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. | medium | 6.1 | 1% |
| CVE-2014-6444 | titan-framework (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject | medium | 6.1 | 1% |
| CVE-2015-2329 | woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary we | medium | 6.1 | 1% |
| CVE-2020-11731 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assista | medium | 6.1 | 1% |
| CVE-2022-3608 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ vulnerable to Cross-site Scripting | high | 8.4 | 1% |
| CVE-2017-1000015 | phpmyadmin/phpmyadmin | phpMyAdmin CSS Injection Vulnerability | medium | 6.1 | 1% |
| CVE-2020-7996 | dolibarr/dolibarr | XSS in Dolibarr ERP & CRM | medium | 6.1 | 1% |
| CVE-2020-24313 | ultimate-appointment-scheduling (WordPress plugin) | Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointmen | medium | 6.1 | 1% |
| CVE-2021-24124 | wp-shieldon (WordPress plugin) | Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflect | medium | 6.1 | 1% |
| CVE-2020-11083 | october/backend | Stored XSS in October | low | 3.5 | 1% |
| CVE-2020-13094 | dolibarr/dolibarr | XSS in Dolibarr | medium | 5.4 | 1% |
| CVE-2019-13463 | simple-link-directory (WordPress plugin) | An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers | medium | 6.1 | 1% |
| CVE-2024-11388 | dino-game (WordPress plugin) | The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu | medium | 6.4 | 1% |
| CVE-2015-8755 | typo3/cms | Typo3 XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2021-39349 | author-bio-box (WordPress plugin) | The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via s | medium | 5.5 | 1% |
| CVE-2022-1557 | uleak-security-dashboard (WordPress plugin) | The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and i | medium | 5.4 | 1% |
| CVE-2020-17551 | impresscms/impresscms | Cross-site scripting (XSS) | medium | 4.8 | 1% |
| CVE-2017-10795 | intelliants/subrion | Subrion Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2023-5538 | mpoperationlogs (WordPress plugin) | The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and incl | high | 7.2 | 1% |
| CVE-2021-24310 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allow | medium | 4.8 | 1% |
| CVE-2019-13414 | rencontre (WordPress plugin) | The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php. | medium | 6.1 | 1% |
| CVE-2021-32478 | moodle/moodle | Moodle reflected XSS | medium | 6.1 | 1% |
| CVE-2012-1209 | forkcms/forkcms | Fork CMS XSS via Highlight Parameter | medium | 0.0 | 1% |
| CVE-2021-24833 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview mod | medium | 5.4 | 1% |
| CVE-2014-2297 | videowhisper-live-streaming-integration (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote | medium | 6.1 | 1% |
| CVE-2017-9419 | wp-custom-fields-search (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inj | medium | 6.1 | 1% |
| CVE-2023-5244 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-1961 | duracelltomi-google-tag-manager (WordPress plugin) | The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4 | medium | 5.5 | 1% |
| CVE-2017-14920 | egroupware/egroupware | eGroupware Community Edition Stored XSS vulnerability | medium | 6.1 | 1% |
| CVE-2022-1167 | careerup (WordPress plugin) | There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the fi | medium | 6.1 | 1% |
| CVE-2015-3998 | adsense-click-fraud-monitoring (WordPress plugin) | Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows | medium | 6.1 | 1% |
| CVE-2016-10970 | supportflow (WordPress plugin) | The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt. | medium | 6.1 | 1% |
| CVE-2021-24153 | wordpress-seo (WordPress plugin) | A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filt | medium | 5.4 | 1% |
| CVE-2022-2089 | bold-page-builder (WordPress plugin) | The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2019-17223 | dolibarr/dolibarr | Dolibarr ERP and CRM HTML Injection | medium | 6.1 | 1% |
| CVE-2018-19995 | dolibarr/dolibarr | Dolibarr stored cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2019-14881 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2016-10890 | aryo-activity-log (WordPress plugin) | The aryo-activity-log plugin before 2.3.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2021-24985 | easy-forms-for-mailchimp (WordPress plugin) | The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outp | medium | 6.1 | 1% |
| CVE-2021-41750 | nystudio107/craft-seomatic | Cross-site Scripting in SEOmatic plugin | medium | 6.1 | 1% |