Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-18495 | gravity-forms-sms-notifications (WordPress plugin) | The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18497 | liveforms (WordPress plugin) | The liveforms plugin before 3.4.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18498 | simple-job-board (WordPress plugin) | The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. | medium | 6.1 | 1% |
| CVE-2017-18507 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18572 | gnucommerce (WordPress plugin) | The gnucommerce plugin before 1.4.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18575 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues. | medium | 6.1 | 1% |
| CVE-2018-20963 | contact-form-to-email (WordPress plugin) | The contact-form-to-email plugin before 1.2.66 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2018-20982 | media-library-assistant (WordPress plugin) | The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin subme | medium | 6.1 | 1% |
| CVE-2020-9393 | pricing-table-by-supsystic (WordPress plugin) | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS. | medium | 6.1 | 1% |
| CVE-2021-39328 | simple-job-board (WordPress plugin) | The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_po | medium | 5.5 | 1% |
| CVE-2021-39357 | leaky-paywall (WordPress plugin) | The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via th | medium | 5.5 | 1% |
| CVE-2022-0719 | microweber/microweber | Cross-site Scripting in Microweber | high | 7.6 | 1% |
| CVE-2017-18520 | democracy-poll (WordPress plugin) | The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php. | medium | 6.1 | 1% |
| CVE-2017-18615 | kama-clic-counter (WordPress plugin) | The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-20019 | content-text-slider-on-post (WordPress plugin) | The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could | medium | 5.4 | 1% |
| CVE-2008-7321 | tubepress (WordPress plugin) | The tubepress plugin before 1.6.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2012-6714 | count-per-day (WordPress plugin) | The count-per-day plugin before 3.2.3 for WordPress has XSS via search words. | medium | 6.1 | 1% |
| CVE-2012-6715 | formbuilder (WordPress plugin) | The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header. | medium | 6.1 | 1% |
| CVE-2012-6716 | events-manager (WordPress plugin) | The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links. | medium | 6.1 | 1% |
| CVE-2013-7477 | events-manager (WordPress plugin) | The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. | medium | 6.1 | 1% |
| CVE-2013-7478 | events-manager (WordPress plugin) | The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post. | medium | 6.1 | 1% |
| CVE-2013-7479 | events-manager (WordPress plugin) | The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. | medium | 6.1 | 1% |
| CVE-2013-7480 | events-manager (WordPress plugin) | The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. | medium | 6.1 | 1% |
| CVE-2013-7482 | reflex-gallery (WordPress plugin) | The reflex-gallery plugin before 1.4.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2014-10378 | duplicate-post (WordPress plugin) | The duplicate-post plugin before 2.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2014-10380 | profile-builder (WordPress plugin) | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms. | medium | 6.1 | 1% |
| CVE-2014-10393 | cforms2 (WordPress plugin) | The cforms2 plugin before 10.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2014-10395 | cp-polls (WordPress plugin) | The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list. | medium | 6.1 | 1% |
| CVE-2015-9317 | awesome-support (WordPress plugin) | The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages. | medium | 6.1 | 1% |
| CVE-2015-9319 | gregs-high-performance-seo (WordPress plugin) | The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser. | medium | 6.1 | 1% |
| CVE-2015-9321 | shortcode-factory (WordPress plugin) | The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg. | medium | 6.1 | 1% |
| CVE-2015-9327 | flickr-justified-gallery (WordPress plugin) | The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9329 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2015-9342 | wp-rollback (WordPress plugin) | The wp-rollback plugin before 1.2.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9346 | cp-polls (WordPress plugin) | The cp-polls plugin before 1.0.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9347 | wp-plotly (WordPress plugin) | The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors. | medium | 6.1 | 1% |
| CVE-2015-9349 | ckeditor-for-wordpress (WordPress plugin) | The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser. | medium | 6.1 | 1% |
| CVE-2015-9350 | feed-them-social (WordPress plugin) | The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button. | medium | 6.1 | 1% |
| CVE-2016-10895 | option-tree (WordPress plugin) | The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request. | medium | 6.1 | 1% |
| CVE-2016-10896 | seo-redirection (WordPress plugin) | The seo-redirection plugin before 4.3 for WordPress has stored XSS. | medium | 6.1 | 1% |
| CVE-2016-10897 | sermon-browser (WordPress plugin) | The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2016-10898 | total-security (WordPress plugin) | The total-security plugin before 3.4.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10900 | uji-countdown (WordPress plugin) | The uji-countdown plugin before 2.0.7 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10901 | wp-customer-reviews (WordPress plugin) | The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools. | medium | 6.1 | 1% |
| CVE-2016-10908 | booking-calendar-contact-form (WordPress plugin) | The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10910 | formbuilder (WordPress plugin) | The formbuilder plugin before 1.06 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2016-10911 | profile-builder (WordPress plugin) | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2016-10912 | universal-analytics (WordPress plugin) | The universal-analytics plugin before 1.3.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10913 | wp-latest-posts (WordPress plugin) | The wp-latest-posts plugin before 3.7.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10934 | check-email (WordPress plugin) | The check-email plugin before 0.5.2 for WordPress has XSS. | medium | 6.1 | 1% |