Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1396 | donorbox (WordPress plugin) | The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, lead | medium | 4.8 | 1% |
| CVE-2022-1558 | curtain (WordPress plugin) | The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-1559 | clipr (WordPress plugin) | The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to | medium | 4.8 | 1% |
| CVE-2021-40926 | james-heinrich/getid3 | Cross-site scripting in demos/demo.mysqli.php in getID3 | medium | 6.1 | 1% |
| CVE-2024-11199 | rescue-shortcodes (WordPress plugin) | The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rescue_progressbar shortcode in all | medium | 6.4 | 1% |
| CVE-2021-25017 | tutor-lms (WordPress plugin) | The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page | medium | 6.1 | 1% |
| CVE-2017-1000193 | october/october | October CMS XSS | medium | 6.1 | 1% |
| CVE-2016-7111 | mantisbt/mantisbt | MantisBT XSS through weak CSP when using Gravatar plugin | medium | 4.7 | 1% |
| CVE-2020-15276 | baserproject/basercms | Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0 | high | 7.7 | 1% |
| CVE-2022-21715 | codeigniter4/framework | Cross-site Scripting Vulnerability in CodeIgniter4 | medium | 5.4 | 1% |
| CVE-2015-9305 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions. | medium | 6.1 | 1% |
| CVE-2021-24954 | user-registration\,-login-form\,-user-profile-\&-membership (WordPress plugin) | The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data p | medium | 6.1 | 1% |
| CVE-2021-24955 | user-registration\,-login-form\,-user-profile-\&-membership (WordPress plugin) | The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_ | medium | 6.1 | 1% |
| CVE-2022-30120 | concrete5/core | Cross site scripting in Concrete CMS | low | 3.1 | 1% |
| CVE-2018-17876 | web-feet/coastercms | Coaster CMS Stored Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-0576 | librenms/librenms | Cross-site Scripting in librenms | medium | 6.1 | 1% |
| CVE-2023-1780 | companion-sitemap-generator (WordPress plugin) | The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pa | medium | 6.1 | 1% |
| CVE-2020-24145 | cm-download-manager (WordPress plugin) | Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attac | medium | 6.1 | 1% |
| CVE-2021-20279 | moodle/moodle | Moodle contains Stored XSS via ID number user profile field | medium | 5.4 | 1% |
| CVE-2023-31506 | getgrav/grav | Cross-site scripting (XSS) vulnerability in Grav | medium | 5.4 | 1% |
| CVE-2015-9356 | wp-vipergb (WordPress plugin) | The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460. | medium | 6.1 | 1% |
| CVE-2015-9361 | related-posts (WordPress plugin) | The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2018-6891 | bookly-responsive-appointment-booking-tool (WordPress plugin) | Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js. | medium | 6.1 | 1% |
| CVE-2019-15817 | easy-property-listings (WordPress plugin) | The easy-property-listings plugin before 3.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9229 | nextgen-gallery (WordPress plugin) | In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated | medium | 4.8 | 1% |
| CVE-2022-34257 | magento/community-edition | Magento stored Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2020-7228 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. | medium | 5.4 | 1% |
| CVE-2012-6146 | typo3/cms | Typo3 Backend History Module Vulnerable to XSS | medium | 0.0 | 1% |
| CVE-2014-9120 | intelliants/subrion | Subrion CMS Cross-site scripting in search | medium | 0.0 | 1% |
| CVE-2022-1504 | microweber/microweber | Cross-site Scripting in microweber | medium | 6.3 | 1% |
| CVE-2022-23598 | laminas/laminas-form | Cross-site Scripting when rendering error messages in laminas-form | medium | 6.1 | 1% |
| CVE-2022-3484 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cr | medium | 6.1 | 1% |
| CVE-2021-39355 | indeed-job-importer (WordPress plugin) | The Indeed Job Importer WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization | medium | 5.5 | 1% |
| CVE-2021-39356 | content-staging (WordPress plugin) | The Content Staging WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via seve | medium | 5.5 | 1% |
| CVE-2015-9355 | two-factor-authentication (WordPress plugin) | The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area. | medium | 6.1 | 1% |
| CVE-2018-7274 | yab/quarx | Yab Quarx persistent cross-site scripting vulnerability | medium | 6.1 | 1% |
| CVE-2021-27902 | craftcms/cms | Craft CMS Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2023-4636 | user-private-files (WordPress plugin) | The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, an | medium | 4.4 | 1% |
| CVE-2015-9270 | the-holiday-calendar (WordPress plugin) | XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter. | medium | 6.1 | 1% |
| CVE-2015-9384 | relevant (WordPress plugin) | The relevant plugin before 1.0.8 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9385 | quotes-and-tips (WordPress plugin) | The quotes-and-tips plugin before 1.20 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9396 | auto-thickbox-plus (WordPress plugin) | The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS. | medium | 6.1 | 1% |
| CVE-2015-9411 | postmatic (WordPress plugin) | The Postmatic plugin before 1.4.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9468 | broken-link-manager (WordPress plugin) | The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action. | medium | 6.1 | 1% |
| CVE-2016-11013 | wp-listings (WordPress plugin) | The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS. | medium | 6.1 | 1% |
| CVE-2019-15833 | simple-mail-address-encoder (WordPress plugin) | The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2013-7472 | count-per-day (WordPress plugin) | The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter. | medium | 6.1 | 1% |
| CVE-2020-25628 | moodle/moodle | Cross site-scripting (XSS) moodle | medium | 6.1 | 1% |
| CVE-2020-27356 | debug-meta-data (WordPress plugin) | The debug-meta-data plugin 1.1.2 for WordPress allows XSS. | medium | 5.4 | 1% |
| CVE-2017-1002011 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and | medium | 5.4 | 1% |