Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-5732 | WordPress core | Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPres | medium | 4.3 | 7% |
| CVE-2015-2315 | wpml (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web scrip | medium | 4.3 | 7% |
| CVE-2007-5710 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web scr | low | 2.6 | 7% |
| CVE-2013-1463 | wp-table-reloaded (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allow | medium | 4.3 | 7% |
| CVE-2015-5714 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leverag | medium | 6.1 | 7% |
| CVE-2021-25079 | contact-form-entries (WordPress plugin) | The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, o | medium | 6.1 | 7% |
| CVE-2015-5734 | WordPress core | Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allow | medium | 4.3 | 7% |
| CVE-2014-9444 | frontend-uploader (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web | medium | 4.3 | 7% |
| CVE-2021-24316 | mediumish (WordPress plugin) | The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back t | medium | 6.1 | 6% |
| CVE-2015-1494 | fancybox-for-wordpress (WordPress plugin) | The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cro | medium | 4.3 | 6% |
| CVE-2015-3300 | thecartpress (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Pl | medium | 4.3 | 6% |
| CVE-2020-24912 | qcubed/qcubed | qcubed reflected cross-site scripting (XSS) vulnerability | medium | 6.1 | 6% |
| CVE-2021-24237 | findeo (WordPress plugin), realteo (WordPress plugin) | The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms | medium | 6.1 | 6% |
| CVE-2015-1366 | pixabay-images (WordPress plugin) | Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers | medium | 4.3 | 6% |
| CVE-2014-5345 | disqus-comment-system (WordPress plugin) | Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attacker | medium | 4.3 | 6% |
| CVE-2015-4063 | newstatpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote auth | low | 3.5 | 6% |
| CVE-2018-10371 | wf-cookie-consent (WordPress plugin) | An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has | medium | 6.1 | 6% |
| CVE-2020-9691 | magento/community-edition, magento/project-community-edition | Magento DOM-based Cross-site scripting vulnerability | critical | 9.6 | 6% |
| CVE-2022-2383 | feed-them-social (WordPress plugin) | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 6% |
| CVE-2016-4566 | WordPress core | Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote at | medium | 6.1 | 6% |
| CVE-2025-8100 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' p | medium | 5.4 | 6% |
| CVE-2019-19134 | hero-maps-premium (WordPress plugin) | The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter bec | medium | 6.1 | 6% |
| CVE-2022-0448 | cp-blocks (WordPress plugin) | The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users | medium | 4.8 | 6% |
| CVE-2021-24245 | stop-spammers (WordPress plugin) | The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting | medium | 6.1 | 6% |
| CVE-2019-16332 | api-bearer-auth (WordPress plugin) | In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php f | medium | 6.1 | 6% |
| CVE-2021-21030 | magento/community-edition, magento/project-community-edition | Magento stored cross-site scripting (XSS) in the customer address upload feature | high | 8.1 | 6% |
| CVE-2020-29304 | directories-pro (WordPress plugin) | A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows atta | medium | 6.1 | 6% |
| CVE-2019-16525 | checklist (WordPress plugin) | An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklis | medium | 6.1 | 6% |
| CVE-2021-24299 | redi-restaurant-reservation (WordPress plugin) | The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These | medium | 6.1 | 6% |
| CVE-2021-24610 | translatepress (WordPress plugin) | The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_strin | medium | 4.8 | 5% |
| CVE-2018-8729 | aryo-activity-log (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject a | medium | 6.1 | 5% |
| CVE-2019-16118 | photo-gallery (WordPress plugin) | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Option | medium | 6.1 | 5% |
| CVE-2013-6281 | dhtmlxspreadsheet (WordPress plugin) | Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows | medium | 4.3 | 5% |
| CVE-2020-8091 | typo3/cms | Typo3 Cross-Site Scripting in Flash component (ELTS) | medium | 6.1 | 5% |
| CVE-2021-39348 | learnpress (WordPress plugin) | The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter f | medium | 5.5 | 5% |
| CVE-2019-16223 | WordPress core | WordPress before 5.2.3 allows XSS in post previews by authenticated users. | medium | 5.4 | 5% |
| CVE-2022-28508 | mantisbt/mantisbt | MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php | medium | 6.1 | 5% |
| CVE-2014-9031 | WordPress core | Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 a | medium | 4.3 | 5% |
| CVE-2017-17043 | emag-marketplace-connector (WordPress plugin) | The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketp | medium | 6.1 | 5% |
| CVE-2017-17451 | wp-mailster (WordPress plugin) | The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2 | medium | 6.1 | 5% |
| CVE-2015-3439 | WordPress core | Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3 | medium | 4.3 | 5% |
| CVE-2008-0192 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or | medium | 4.3 | 5% |
| CVE-2021-24901 | security-audit (WordPress plugin) | The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users t | medium | 4.8 | 5% |
| CVE-2021-24904 | mortgage-calculators-wp (WordPress plugin) | The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a cal | medium | 4.8 | 5% |
| CVE-2012-6622 | forumpress (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordP | medium | 4.3 | 5% |
| CVE-2019-20141 | neon (WordPress theme) | An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter. | medium | 6.1 | 5% |
| CVE-2008-1304 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the | medium | 4.3 | 5% |
| CVE-2015-5733 | WordPress core | Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4 | medium | 4.3 | 5% |
| CVE-2015-5622 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML | low | 3.5 | 5% |
| CVE-2015-2321 | job-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitr | medium | 4.3 | 5% |