Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9439 | addthis (WordPress plugin) | The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget p | medium | 4.8 | 1% |
| CVE-2017-7251 | pi/pi | Pi Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2018-16808 | dolibarr/dolibarr | Dolibarr Stored Cross-site Scripting in expensereport/card.php | medium | 6.1 | 1% |
| CVE-2019-1010016 | dolibarr/dolibarr | Dolibarr Cross Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2021-42220 | dolibarr/dolibarr | Dolibarr Cross Site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2016-10878 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-2515 | simple-banner (WordPress plugin) | The Simple Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `pro_version_activation_code` parameter in versi | medium | 6.4 | 1% |
| CVE-2015-9493 | my-wish-list (WordPress plugin) | The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2015-9501 | artificial-intelligence (WordPress theme) | The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web ro | medium | 6.1 | 1% |
| CVE-2017-18608 | spotim-comments (WordPress plugin) | The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2020-25033 | subscribe-sidebar (WordPress plugin) | The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS. | medium | 6.1 | 1% |
| CVE-2021-30458 | wikimedia/parsoid | Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-43500 | WordPress core | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scri | medium | 6.1 | 1% |
| CVE-2022-0565 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.4 | 1% |
| CVE-2021-39346 | google-maps-easy (WordPress plugin) | The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via | medium | 4.8 | 1% |
| CVE-2018-20970 | pdf-print (WordPress plugin) | The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2025-69210 | facturascripts/facturascripts | FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload | high | 0.0 | 1% |
| CVE-2024-34070 | froxlor/froxlor | Blind XSS Leading to Froxlor Application Compromise | critical | 9.6 | 1% |
| CVE-2015-9357 | akismet (WordPress plugin) | The akismet plugin before 3.1.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-15116 | easy-digital-downloads (WordPress plugin) | The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging. | medium | 6.1 | 1% |
| CVE-2021-38320 | simplesamlphp-authentication (WordPress plugin) | The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] va | medium | 6.1 | 1% |
| CVE-2017-15811 | pootle-button (WordPress plugin) | The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admi | medium | 5.4 | 1% |
| CVE-2022-2470 | microweber/microweber | Microweber before 1.2.21 vulnerable to reflected XSS | medium | 6.1 | 1% |
| CVE-2021-43409 | wordpress-\+-azure-ad-\/-microsoft-office-365 (WordPress plugin) | The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (X | critical | 9.3 | 1% |
| CVE-2018-1045 | moodle/moodle | Moodle XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2013-5002 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site scripting (XSS) vulnerability via pageNumber value | low | 0.0 | 1% |
| CVE-2014-2571 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2017-18612 | wp-whois-domain (WordPress plugin) | The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. | medium | 6.1 | 1% |
| CVE-2017-18613 | trust-form (WordPress plugin) | The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. | medium | 6.1 | 1% |
| CVE-2019-17236 | igniteup (WordPress plugin) | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS. | medium | 6.1 | 1% |
| CVE-2020-15241 | typo3/cms, typo3/cms-core, typo3fluid/fluid | Cross-Site Scripting in ternary conditional operator | medium | 4.7 | 1% |
| CVE-2024-26483 | getkirby/cms | Kirby vulnerable to unrestricted file upload of user avatar images | medium | 4.6 | 1% |
| CVE-2016-10706 | jetpack (WordPress plugin) | The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. | medium | 6.1 | 1% |
| CVE-2020-14206 | divebook (WordPress plugin) | The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter). | medium | 6.1 | 1% |
| CVE-2024-6529 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, | high | 7.1 | 1% |
| CVE-2015-9303 | simple-share-buttons-adder (WordPress plugin) | The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9306 | wp-ultimate-csv-importer (WordPress plugin) | The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-5942 | wp-mail (WordPress plugin) | An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected X | medium | 6.1 | 1% |
| CVE-2016-10975 | fluid-responsive-slideshow (WordPress plugin) | The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter. | medium | 6.1 | 1% |
| CVE-2016-10980 | kento-post-view-counter (WordPress plugin) | The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo. | medium | 6.1 | 1% |
| CVE-2016-10981 | kento-post-view-counter (WordPress plugin) | The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_t | medium | 6.1 | 1% |
| CVE-2024-21910 | tinymce/tinymce | Cross-site scripting vulnerability in TinyMCE plugins | medium | 6.1 | 1% |
| CVE-2022-2066 | facturascripts/facturascripts | Cross site scripting in facturascripts | medium | 6.1 | 1% |
| CVE-2017-15051 | nilsteampassnet/teampass | TeamPass stored cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2017-15863 | wp-noexternallinks (WordPress plugin) | Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/ | medium | 6.1 | 1% |
| CVE-2018-5653 | pinterest-feeds (WordPress plugin) | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizar_pffr | medium | 6.1 | 1% |
| CVE-2018-5654 | pinterest-feeds (WordPress plugin) | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREE_Access | medium | 6.1 | 1% |
| CVE-2021-39345 | hal (WordPress plugin) | The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several para | medium | 5.5 | 1% |
| CVE-2010-3672 | typo3/cms-fluid | TYPO3 vulnerable to Cross-Site Scripting in the textarea view helper | medium | 6.1 | 1% |
| CVE-2016-10705 | jetpack (WordPress plugin) | The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. | medium | 6.1 | 1% |