Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-24749 | sylius/sylius | Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius | medium | 6.1 | 1% |
| CVE-2010-5100 | typo3/cms-install | TYPO3 Cross-Site Scripting vulnerability in the Install Tool | low | 0.0 | 1% |
| CVE-2022-0690 | microweber/microweber | Cross-site Scripting in microweber | high | 8.8 | 1% |
| CVE-2016-10736 | social-pug (WordPress plugin) | The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_ | medium | 6.1 | 1% |
| CVE-2020-25812 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2020-25815 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2020-35947 | pagelayer (WordPress plugin) | An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks | high | 7.4 | 1% |
| CVE-2015-9444 | altos-connect (WordPress plugin) | The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ P | medium | 6.1 | 1% |
| CVE-2018-25047 | smarty/smarty | Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto | medium | 5.4 | 1% |
| CVE-2018-14846 | multi-step-form (WordPress plugin) | The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php. | medium | 5.4 | 1% |
| CVE-2020-26211 | ssddanbrown/bookstack | Bookstack Cross-site Scripting vulnerability | high | 8.7 | 1% |
| CVE-2022-1820 | keep-backup-daily (WordPress plugin) | The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and incl | medium | 6.1 | 1% |
| CVE-2022-1822 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up t | medium | 6.1 | 1% |
| CVE-2023-5863 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2013-5988 | all-in-one-seo-pack (WordPress plugin) | A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter. | medium | 6.1 | 1% |
| CVE-2013-7074 | typo3/cms | TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component | low | 3.0 | 1% |
| CVE-2021-24526 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title be | medium | 5.4 | 1% |
| CVE-2021-25067 | landing-page (WordPress plugin) | The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page. | medium | 5.4 | 1% |
| CVE-2023-2341 | pimcore/pimcore | Cross-site Scripting (XSS) in Admin Login too many attempts notice | medium | 6.1 | 1% |
| CVE-2024-11954 | pimcore/pimcore | Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document | high | 8.1 | 1% |
| CVE-2020-25828 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-27673 | tribalsystems/zenario | reflected XSS in tribalsystems/zenario | medium | 4.8 | 1% |
| CVE-2008-5644 | typo3/cms-backend | TYPO3 Cross-site Scripting vulnerability in the file backend module | medium | 0.0 | 1% |
| CVE-2011-2509 | joomla/joomla-cms | Joomla! vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2019-18982 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-20751 | ec-cube/ec-cube | EC-CUBE Cross-site scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-26980 | nilsteampassnet/teampass | Cross-site Scripting in teampass | medium | 6.1 | 1% |
| CVE-2019-12566 | wp-statistics (WordPress plugin) | The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an accoun | medium | 5.4 | 1% |
| CVE-2017-20192 | formidable (WordPress plugin) | The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form | high | 8.3 | 1% |
| CVE-2017-1000506 | mautic/core | Mautic Cross Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-24135 | wp-customer-reviews (WordPress plugin) | Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cr | medium | 6.1 | 1% |
| CVE-2010-4616 | impresscms/impresscms | ImpressCMS Cross-site Scripting vulnerability via quicksearch_ContentContent parameter | medium | 0.0 | 1% |
| CVE-2022-2101 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, | medium | 6.4 | 1% |
| CVE-2016-4056 | typo3/cms | TYPO3 Backend component Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2022-0929 | microweber/microweber | Cross-site Scripting in microweber | medium | 6.8 | 1% |
| CVE-2021-39344 | kjm-admin-notices (WordPress plugin) | The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization vi | medium | 5.5 | 1% |
| CVE-2015-9500 | exquisite-ultimate-newspaper (WordPress theme) | The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js. | medium | 6.1 | 1% |
| CVE-2015-5337 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-35651 | moodle/moodle | Moodle Stored XSS and blind SSRF possible via SCORM track details | medium | 6.1 | 1% |
| CVE-2023-50891 | zoho-forms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Form plugin for WordPress – | medium | 6.5 | 1% |
| CVE-2018-19992 | dolibarr/dolibarr | Dolibarr stored cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2019-19306 | zoho-crm-forms (WordPress plugin) | The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName. | medium | 5.4 | 1% |
| CVE-2019-12346 | saml-sp-single-sign-on (WordPress plugin) | In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially cr | medium | 6.1 | 1% |
| CVE-2024-21908 | tinymce/tinymce | Cross-site scripting vulnerability in TinyMCE | medium | 6.1 | 1% |
| CVE-2021-33988 | microweber/microweber | Cross Site Scripting in Microweber | medium | 0.0 | 1% |
| CVE-2019-14792 | wp-google-maps (WordPress plugin) | The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter. | medium | 5.4 | 1% |
| CVE-2019-15777 | shapepress-dsgvo (WordPress plugin) | The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS. | medium | 5.4 | 1% |
| CVE-2019-15827 | onesignal-free-web-push-notifications (WordPress plugin) | The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter. | medium | 5.4 | 1% |
| CVE-2018-1136 | moodle/moodle | Moodle Cross-site Scripting | medium | 4.3 | 1% |
| CVE-2017-1000038 | relevanssi (WordPress plugin) | WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affect | medium | 6.1 | 1% |