Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9401 | websimon-tables (WordPress plugin) | The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS. | medium | 4.8 | 1% |
| CVE-2019-16522 | eu-cookie-law (WordPress plugin) | The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of sev | medium | 4.8 | 1% |
| CVE-2008-3032 | mehrwert/phpmyadmin | phpMyAdmin extension for TYPO3 has Cross-site Scripting vulnerability | medium | 0.0 | 1% |
| CVE-2020-15273 | baserproject/basercms | Edit feed settings and others, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0 | high | 7.3 | 1% |
| CVE-2019-17205 | nilsteampassnet/teampass | TeamPass Stored Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2019-10909 | drupal/core, drupal/drupal, symfony/framework-bundle +1 more | Symfony Cross-site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2018-11326 | joomla/joomla-cms | Joomla! XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2024-20759 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Scripting (XSS) | high | 8.1 | 1% |
| CVE-2019-16289 | insert-php (WordPress plugin) | The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter. | medium | 5.4 | 1% |
| CVE-2017-16758 | ultimate-instagram-feed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for | medium | 4.8 | 1% |
| CVE-2018-6194 | wp-splashing-images (WordPress plugin) | A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-ima | medium | 4.8 | 1% |
| CVE-2018-0579 | wonderm00ns-simple-facebook-open-graph-tags (WordPress plugin) | Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress a | medium | 6.1 | 1% |
| CVE-2020-29315 | zoujingli/thinkadmin | Cross-site scripting in ThinkAdmin | medium | 5.4 | 1% |
| CVE-2020-28707 | stockdio-historical-chart (WordPress plugin) | The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.j | medium | 6.1 | 1% |
| CVE-2020-9459 | modern-events-calendar-lite (WordPress plugin) | Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allo | medium | 5.4 | 1% |
| CVE-2019-16524 | easy-fancybox (WordPress plugin) | The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfan | medium | 4.8 | 1% |
| CVE-2018-18460 | wp-live-chat-support (WordPress plugin) | XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivech | medium | 6.1 | 1% |
| CVE-2018-9020 | events-manager (WordPress plugin) | The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature. | medium | 5.4 | 1% |
| CVE-2018-18017 | slideshow-gallery (WordPress plugin) | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gal | medium | 6.1 | 1% |
| CVE-2018-18019 | slideshow-gallery (WordPress plugin) | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[ | medium | 6.1 | 1% |
| CVE-2015-9386 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation. | medium | 6.1 | 1% |
| CVE-2015-9416 | sitepress-multilingual-cms (WordPress plugin) | The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header. | medium | 6.1 | 1% |
| CVE-2015-9459 | searchterms-tagging-2 (WordPress plugin) | The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter. | medium | 6.1 | 1% |
| CVE-2016-10957 | akal (WordPress theme) | The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter. | medium | 6.1 | 1% |
| CVE-2016-10961 | colorway (WordPress theme) | The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter. | medium | 6.1 | 1% |
| CVE-2016-10964 | dwnldr (WordPress plugin) | The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header. | medium | 6.1 | 1% |
| CVE-2016-10967 | real3d-flipbook-lite (WordPress plugin) | The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter | medium | 6.1 | 1% |
| CVE-2016-11005 | instalinker (WordPress plugin) | The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS. | medium | 6.1 | 1% |
| CVE-2019-14774 | woo-variation-swatches (WordPress plugin) | The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=w | medium | 6.1 | 1% |
| CVE-2018-5212 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit | medium | 5.4 | 1% |
| CVE-2018-5213 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action | medium | 5.4 | 1% |
| CVE-2020-35129 | mautic/core | Mautic stored Cross-site Scripting (XSS) | critical | 9.0 | 1% |
| CVE-2019-15830 | icegram (WordPress plugin) | The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS. | medium | 5.4 | 1% |
| CVE-2022-25601 | contact-form-x (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4). | medium | 4.7 | 1% |
| CVE-2017-16815 | duplicator (WordPress plugin) | installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values | medium | 6.1 | 1% |
| CVE-2023-28447 | smarty/smarty | smarty Cross-site Scripting vulnerability in Javascript escaping | high | 7.1 | 1% |
| CVE-2016-11085 | quiz-and-survey-master (WordPress plugin) | php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the | medium | 6.5 | 1% |
| CVE-2014-5274 | phpmyadmin/phpmyadmin | phpMyAdmin cross-site scripting vulnerability in crafted view name | low | 0.0 | 1% |
| CVE-2022-23494 | tinymce/tinymce | Cross-site scripting vulnerability in TinyMCE alerts | medium | 5.4 | 1% |
| CVE-2017-5870 | opensolutions/vimbadmin | ViMbAdmin Cross-site Scripting Vulnerabilities | medium | 5.4 | 1% |
| CVE-2014-4036 | impresscms/impresscms | ImpressCMS Cross-site scripting Vulnerability | medium | 0.0 | 1% |
| CVE-2020-15154 | baserproject/basercms | Cross Site Scripting in baserCMS | high | 7.3 | 1% |
| CVE-2015-9495 | syndication-links (WordPress plugin) | The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier. | medium | 6.1 | 1% |
| CVE-2017-17971 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-18603 | postman-smtp (WordPress plugin) | The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter. | medium | 6.1 | 1% |
| CVE-2020-24699 | chamber-dashboard-business-directory (WordPress plugin) | The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS. | medium | 6.1 | 1% |
| CVE-2020-27344 | cm-download-manager (WordPress plugin) | The cm-download-manager plugin before 2.8.0 for WordPress allows XSS. | medium | 6.1 | 1% |
| CVE-2024-4455 | yith-woocommerce-ajax-search (WordPress plugin) | The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up t | high | 7.2 | 1% |
| CVE-2019-9669 | wordfence (WordPress plugin) | The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerab | medium | 6.1 | 1% |
| CVE-2020-23761 | intelliants/subrion | subrion CMS Cross Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |