Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-19785 | athlon1600/php-proxy-app | XSS in PHP-Proxy-App through v3.0 | medium | 6.1 | 1% |
| CVE-2019-17070 | liquid-speech-balloon (WordPress plugin) | The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer. | medium | 6.1 | 1% |
| CVE-2019-17071 | client-dash (WordPress plugin) | The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS. | medium | 6.1 | 1% |
| CVE-2019-17384 | animate-it (WordPress plugin) | The animate-it plugin before 2.3.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-17385 | animate-it (WordPress plugin) | The animate-it plugin before 2.3.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2020-29172 | litespeed-cache (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setti | medium | 6.1 | 1% |
| CVE-2021-21365 | bk2k/bootstrap-package | Cross-Site Scripting in Bootstrap Package | medium | 5.4 | 1% |
| CVE-2019-14784 | cp-contact-form-with-paypal (WordPress plugin) | The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition. | medium | 6.1 | 1% |
| CVE-2018-10300 | wd-instagram-feed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to in | medium | 6.1 | 1% |
| CVE-2018-10301 | wd-instagram-feed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attacke | medium | 6.1 | 1% |
| CVE-2017-17719 | wp-concours (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary w | medium | 6.1 | 1% |
| CVE-2017-17744 | custom-map (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary we | medium | 6.1 | 1% |
| CVE-2021-34635 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/setti | medium | 6.1 | 1% |
| CVE-2021-34642 | smart-email-alerts (WordPress plugin) | The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file whi | medium | 6.1 | 1% |
| CVE-2021-34644 | multiplayer-plugin (WordPress plugin) | The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/multi | medium | 6.1 | 1% |
| CVE-2021-34664 | moova-for-woocommerce (WordPress plugin) | The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout. | medium | 6.1 | 1% |
| CVE-2021-38315 | sp-client-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to param | medium | 6.1 | 1% |
| CVE-2021-38316 | wp-academic-people (WordPress plugin) | The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin- | medium | 6.1 | 1% |
| CVE-2021-38323 | rentpress (WordPress plugin) | The RentPress WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the ~/src/rentPress/Aja | medium | 6.1 | 1% |
| CVE-2021-38325 | user-activation-email (WordPress plugin) | The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-act | medium | 6.1 | 1% |
| CVE-2021-38327 | youtube-video-inserter (WordPress plugin) | The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in | medium | 6.1 | 1% |
| CVE-2021-38330 | yabp (WordPress plugin) | The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] valu | medium | 6.1 | 1% |
| CVE-2021-38333 | wp-scrippets (WordPress plugin) | The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp- | medium | 6.1 | 1% |
| CVE-2021-38341 | wc-payment-gateway-per-category (WordPress plugin) | The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["P | medium | 6.1 | 1% |
| CVE-2021-38347 | simple-custom-website-data (WordPress plugin) | The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php | medium | 6.1 | 1% |
| CVE-2021-38355 | bug-library (WordPress plugin) | The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-lib | medium | 6.1 | 1% |
| CVE-2018-16256 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that | medium | 6.1 | 1% |
| CVE-2021-24907 | everest-forms (WordPress plugin) | The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it bac | medium | 6.1 | 1% |
| CVE-2020-15885 | munkireport/comment | MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment | medium | 5.4 | 1% |
| CVE-2015-9494 | indieweb-post-kinds (WordPress plugin) | The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier. | medium | 6.1 | 1% |
| CVE-2015-9504 | weeklynews-theme (WordPress theme) | The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter. | medium | 6.1 | 1% |
| CVE-2019-19111 | wpforo (WordPress plugin) | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. | medium | 6.1 | 1% |
| CVE-2019-19112 | wpforo (WordPress plugin) | The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php. | medium | 6.1 | 1% |
| CVE-2019-19540 | listingpro (WordPress theme) | The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage. | medium | 6.1 | 1% |
| CVE-2020-14010 | xenon (WordPress theme) | The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter. | medium | 6.1 | 1% |
| CVE-2020-16140 | greenmart (WordPress theme) | The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS. | medium | 6.1 | 1% |
| CVE-2020-25378 | wp-floating-menu (WordPress plugin) | Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter. | medium | 6.1 | 1% |
| CVE-2020-25631 | moodle/moodle | Moodle Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2017-18508 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-38080 | exceedone/exment, exceedone/laravel-admin | exceedone/exment and exceedone/laravel-admin Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2014-10392 | cforms2 (WordPress plugin) | The cforms2 plugin before 10.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2018-19564 | easy-testimonials (WordPress plugin) | Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_posi | medium | 6.1 | 1% |
| CVE-2019-14884 | moodle/moodle | Moodle reflected Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2019-15082 | 360-product-rotation (WordPress plugin) | The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2019-15328 | import-users-from-csv-with-meta (WordPress plugin) | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-15643 | ultimate-faqs (WordPress plugin) | The ultimate-faqs plugin before 1.8.22 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-7413 | parallax-scroll (WordPress plugin) | In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via | medium | 6.1 | 1% |
| CVE-2021-24317 | listeo (WordPress plugin) | The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message | medium | 6.1 | 1% |
| CVE-2021-24365 | admin-columns (WordPress plugin) | The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column ha | medium | 5.4 | 1% |
| CVE-2022-36107 | typo3/cms, typo3/cms-core | TYPO3 CMS Stored Cross-Site Scripting via FileDumpController | medium | 5.4 | 1% |