Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-16206 | spam-byebye (WordPress plugin) | Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script | medium | 6.1 | 1% |
| CVE-2023-2256 | product-addons-\&-fields-for-woocommerce (WordPress plugin) | The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Refl | medium | 6.1 | 1% |
| CVE-2015-9302 | simple-fields (WordPress plugin) | The simple-fields plugin before 1.4.11 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10870 | google-language-translator (WordPress plugin) | The google-language-translator plugin before 5.0.06 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10880 | google-document-embedder (WordPress plugin) | The google-document-embedder plugin before 2.6.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10881 | google-document-embedder (WordPress plugin) | The google-document-embedder plugin before 2.6.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-17780 | booking-calendar-sms (WordPress plugin), clockwork-sms-notfications (WordPress plugin), contact-form-7-sms (WordPress plugin) +5 more | The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/ | medium | 6.1 | 1% |
| CVE-2019-6117 | ape-gallery (WordPress plugin) | The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function. | medium | 6.1 | 1% |
| CVE-2015-9359 | jetpack (WordPress plugin) | The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9360 | updraftplus (WordPress plugin) | The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9363 | exchange (WordPress plugin) | iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9364 | ithemes-2checkout (WordPress plugin) | 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9365 | authorize.net (WordPress plugin) | Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9366 | custom-url-tracking (WordPress plugin) | Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9367 | easy-canadian-sales-taxes (WordPress plugin) | Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9368 | easy-eu-value-added-\(vat\)-taxes (WordPress plugin) | Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9369 | easy-us-sales-taxes (WordPress plugin) | Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9370 | invoices (WordPress plugin) | Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9371 | manual-purchases (WordPress plugin) | Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9372 | membership (WordPress plugin) | Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9373 | ithemes-paypal-pro (WordPress plugin) | PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9374 | stripe (WordPress plugin) | Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9375 | table-rate-shipping (WordPress plugin) | Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9376 | mobile (WordPress plugin) | iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9377 | builder-theme-depot (WordPress theme) | iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9378 | builder-theme-market (WordPress theme) | iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9379 | builder-style-manager (WordPress plugin) | iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2019-15838 | custom-404-pro (WordPress plugin) | The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789. | medium | 6.1 | 1% |
| CVE-2019-15864 | breadcrumbs-by-menu (WordPress plugin) | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-1250 | lifterlms (WordPress plugin) | The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before ou | medium | 6.1 | 1% |
| CVE-2019-20389 | intelliants/subrion | Subrion CMS XSS | medium | 6.1 | 1% |
| CVE-2015-9469 | content-grabber (WordPress plugin) | The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id. | medium | 4.8 | 1% |
| CVE-2017-7887 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-15278 | nilsteampassnet/teampass | TeamPass Cross-Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2018-20986 | advanced-custom-fields (WordPress plugin) | The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors. | medium | 5.4 | 1% |
| CVE-2022-33910 | mantisbt/mantisbt | MantisBT XSS through crafted SVG documents in file_download.php | medium | 5.4 | 1% |
| CVE-2019-14949 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 5.1.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2021-39338 | mybb-cross-poster (WordPress plugin) | The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization vi | medium | 5.5 | 1% |
| CVE-2018-7035 | gleez/cms | Gleez CMS Stored XSS | medium | 5.4 | 1% |
| CVE-2018-0585 | ultimate-member (WordPress plugin) | Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrar | medium | 5.4 | 1% |
| CVE-2019-19206 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2022-3072 | francoisjacquet/rosariosis | francoisjacquet/rosariosis vulnerable to Cross-Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2016-10998 | ocim-mp3 (WordPress plugin) | The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS. | medium | 6.1 | 1% |
| CVE-2016-10999 | goodnews (WordPress theme) | The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter. | medium | 6.1 | 1% |
| CVE-2019-12823 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2021-3271 | pressbooks/pressbooks | Stored cross-site scripting in PressBooks | medium | 4.8 | 1% |
| CVE-2021-24808 | bp-better-messages (WordPress plugin) | The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter befo | medium | 6.1 | 1% |
| CVE-2022-4215 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' pag | medium | 6.1 | 1% |
| CVE-2024-45116 | magento/community-edition | Magento Open Source Cross-Site Scripting (XSS) vulnerability | high | 8.1 | 1% |
| CVE-2023-7027 | post-smtp (WordPress plugin) | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stor | high | 7.2 | 1% |