Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-39354 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters fou | medium | 4.8 | 1% |
| CVE-2015-9299 | events-manager (WordPress plugin) | The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS. | medium | 6.1 | 1% |
| CVE-2020-35748 | fv-flowplayer-video-player (WordPress plugin) | Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress a | medium | 5.4 | 1% |
| CVE-2012-5889 | in2code/powermail | powermail extension for TYPO3 has Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2013-1844 | matomo/matomo, piwik/piwik | Piwik (now Matomo) Vulnerable to Cross-Site Scripting (XSS) | low | 0.0 | 1% |
| CVE-2014-6296 | jbartels/wec-map, web-tp3/wec_map | WEC Map (wec_map) extension for TYPO3 allows Cross-site Scripting | low | 0.0 | 1% |
| CVE-2015-3989 | concrete5/concrete5 | concrete5 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2016-10879 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-15842 | easy-pdf-restaurant-menu-upload (WordPress plugin) | The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-36108 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper | medium | 5.4 | 1% |
| CVE-2021-39340 | notification (WordPress plugin) | The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via sev | medium | 4.8 | 1% |
| CVE-2021-39136 | baserproject/basercms | Cross-site scripting vulnerability in file upload | high | 8.7 | 1% |
| CVE-2019-11871 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins. | medium | 5.4 | 1% |
| CVE-2017-6973 | mantisbt/mantisbt | MantisBT XSS via adm_config_report.php's action parameter | medium | 4.8 | 1% |
| CVE-2017-7241 | mantisbt/mantisbt | MantisBT XSS via move_attachments_page.php | medium | 4.8 | 1% |
| CVE-2014-10377 | cforms2 (WordPress plugin) | The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php. | medium | 6.1 | 1% |
| CVE-2018-10704 | yidashi/yii2cmf | Cross-site Scripting in yii2cmf | medium | 6.1 | 1% |
| CVE-2019-16130 | yii2mod/yii2-cms | Cross-site Scripting in YII2-CMS | medium | 6.1 | 1% |
| CVE-2019-19210 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2012-6718 | sharebar (WordPress plugin) | The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491. | medium | 6.1 | 1% |
| CVE-2015-9293 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature. | medium | 6.1 | 1% |
| CVE-2021-41252 | getkirby/cms | Cross-site scripting (XSS) from writer field content in the site frontend | medium | 5.4 | 1% |
| CVE-2015-9297 | events-manager (WordPress plugin) | The events-manager plugin before 5.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9320 | option-tree (WordPress plugin) | The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg. | medium | 6.1 | 1% |
| CVE-2016-10867 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages. | medium | 6.1 | 1% |
| CVE-2016-10873 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10875 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18032 | download-manager (WordPress plugin) | The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-aj | medium | 6.1 | 1% |
| CVE-2019-17239 | download-plugins-dashboard (WordPress plugin) | includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple | medium | 6.1 | 1% |
| CVE-2011-5329 | redirection (WordPress plugin) | The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562. | medium | 6.1 | 1% |
| CVE-2012-6713 | job-manager (WordPress plugin) | The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2012-6717 | redirection (WordPress plugin) | The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562. | medium | 6.1 | 1% |
| CVE-2013-7475 | contact-form-plugin (WordPress plugin) | The contact-form-plugin plugin before 3.52 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2013-7481 | contact-form-plugin (WordPress plugin) | The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2014-10385 | memphis-documents-library (WordPress plugin) | The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST. | medium | 6.1 | 1% |
| CVE-2015-9294 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances. | medium | 6.1 | 1% |
| CVE-2015-9295 | contact-form-plugin (WordPress plugin) | The contact-form-plugin plugin before 3.96 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9296 | download-monitor (WordPress plugin) | The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg. | medium | 6.1 | 1% |
| CVE-2015-9300 | events-manager (WordPress plugin) | The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2015-9311 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.6 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2015-9314 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header. | medium | 6.1 | 1% |
| CVE-2015-9336 | clean-login (WordPress plugin) | The clean-login plugin before 1.5.1 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2015-9358 | feedwordpress (WordPress plugin) | The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9362 | post-connector (WordPress plugin) | The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9505 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x befo | medium | 6.1 | 1% |
| CVE-2015-9506 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 | medium | 6.1 | 1% |
| CVE-2015-9507 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10 | medium | 6.1 | 1% |
| CVE-2015-9508 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | 1% |
| CVE-2015-9509 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0. | medium | 6.1 | 1% |
| CVE-2015-9510 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x | medium | 6.1 | 1% |