Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-11105 | wp-live-chat-support (WordPress plugin) | There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "emai | medium | 6.1 | 1% |
| CVE-2019-15109 | the-events-calendar (WordPress plugin) | The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter. | medium | 6.1 | 1% |
| CVE-2014-7238 | contact-form-integrated-with-google-maps (WordPress plugin) | The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS | medium | 6.1 | 1% |
| CVE-2018-20838 | accelerated-mobile-pages (WordPress plugin) | ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS. | medium | 5.4 | 1% |
| CVE-2011-2935 | elgg/elgg | Elgg Reflected XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2009-0816 | typo3/cms | Typo3 Backend XSS Vulnerability | medium | 0.0 | 1% |
| CVE-2010-3715 | typo3/cms-backend | TYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backend | medium | 0.0 | 1% |
| CVE-2017-2644 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-2645 | moodle/moodle | Moodle XSS in attachments to evidence of prior learning | medium | 6.1 | 1% |
| CVE-2011-4332 | joomla/joomla-cms | Joomla! vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2022-1320 | sliderby10web (WordPress plugin) | The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileg | medium | 4.8 | 1% |
| CVE-2022-1394 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high | medium | 4.8 | 1% |
| CVE-2022-1564 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privil | medium | 4.8 | 1% |
| CVE-2019-10010 | league/commonmark | Moderate severity vulnerability that affects league/commonmark | medium | 6.1 | 1% |
| CVE-2008-5656 | typo3/cms-felogin | typo3/cms-felogin Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2018-11568 | gameplan-event-and-gym-fitness (WordPress theme) | Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated b | medium | 6.1 | 1% |
| CVE-2021-25065 | smash-balloon-social-post-feed (WordPress plugin) | The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin pa | medium | 5.4 | 1% |
| CVE-2015-9304 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. | medium | 6.1 | 1% |
| CVE-2016-10872 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. | medium | 6.1 | 1% |
| CVE-2016-10969 | supportflow (WordPress plugin) | The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title. | medium | 6.1 | 1% |
| CVE-2019-15112 | wp-slimstat (WordPress plugin) | The wp-slimstat plugin before 4.8.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2023-30838 | prestashop/prestashop | Possible XSS injection through Validate::isCleanHTML method | high | 8.0 | 1% |
| CVE-2018-6943 | ultimatemember (WordPress plugin) | core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails | medium | 6.1 | 1% |
| CVE-2021-36568 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-4460 | uploading-svg\,-webp-and-ico-files (WordPress plugin) | The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a ro | medium | 5.4 | 1% |
| CVE-2015-9397 | gocodes (WordPress plugin) | The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS. | medium | 5.4 | 1% |
| CVE-2015-9423 | plugnedit (WordPress plugin) | The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dia | medium | 5.4 | 1% |
| CVE-2015-9436 | dynamic-widgets (WordPress plugin) | The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id paramete | medium | 5.4 | 1% |
| CVE-2015-9438 | display-widgets (WordPress plugin) | The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, o | medium | 5.4 | 1% |
| CVE-2015-9426 | manual-image-crop (WordPress plugin) | The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window | medium | 4.6 | 1% |
| CVE-2017-7271 | yiisoft/yii2 | Yii Framework Reflected XSS | medium | 6.1 | 1% |
| CVE-2019-7939 | magento/community-edition, magento/product-community-edition | Magento Reflected cross-site scripting on customer cart page | medium | 6.1 | 1% |
| CVE-2020-9003 | modula-best-grid-gallery (WordPress plugin) | A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerabili | medium | 5.4 | 1% |
| CVE-2010-1649 | joomla/joomla-cms | Joomla! vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2017-15867 | user-login-history (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to i | medium | 6.1 | 1% |
| CVE-2023-6697 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in al | medium | 6.1 | 1% |
| CVE-2019-14948 | woocommerce-product-addon (WordPress plugin) | The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure. | medium | 5.4 | 1% |
| CVE-2020-26216 | typo3fluid/fluid | Cross-Site Scripting through Fluid view helper arguments | high | 8.0 | 1% |
| CVE-2022-3578 | profilegrid (WordPress plugin) | The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 6.1 | 1% |
| CVE-2019-15778 | woo-variation-gallery (WordPress plugin) | The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS. | medium | 5.4 | 1% |
| CVE-2023-41592 | froala/wysiwyg-editor | Froala Editor Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2018-20965 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 2.0.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2021-39329 | jobboardwp (WordPress plugin) | The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via sever | medium | 5.5 | 1% |
| CVE-2021-39343 | mpl-publisher (WordPress plugin) | The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via se | medium | 5.5 | 1% |
| CVE-2019-18857 | enshrined/svg-sanitize | XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes | high | 7.5 | 1% |
| CVE-2019-14787 | newsletters-lite (WordPress plugin) | The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor c | medium | 5.4 | 1% |
| CVE-2019-14796 | mq-woocommerce-products-price-bulk-edit (WordPress plugin) | The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/ | medium | 5.4 | 1% |
| CVE-2016-10891 | aryo-activity-log (WordPress plugin) | The aryo-activity-log plugin before 2.3.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-14795 | toggle-the-title (WordPress plugin) | The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isA | medium | 4.8 | 1% |
| CVE-2007-3498 | ezyang/htmlpurifier | HTML Purifier Cross-site Scripting vulnerability | medium | 6.1 | 1% |