Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-17096 | content-cards (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary | medium | 6.1 | 1% |
| CVE-2019-15110 | wp-front-end-profile (WordPress plugin) | The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-15327 | import-users-from-csv-with-meta (WordPress plugin) | The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. | medium | 6.1 | 1% |
| CVE-2019-15331 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. | medium | 6.1 | 1% |
| CVE-2020-25102 | silverstripe-australia/advancedreports | silverstripe-advancedreports vulnerable to XSS | medium | 6.1 | 1% |
| CVE-2016-10763 | camptix (WordPress plugin) | The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body. | medium | 4.8 | 1% |
| CVE-2017-20008 | mycred (WordPress plugin) | The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin d | medium | 6.1 | 1% |
| CVE-2017-6103 | anyvar (WordPress plugin) | Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1. | medium | 6.1 | 1% |
| CVE-2023-3086 | nilsteampassnet/teampass | TeamPass vulnerable to stored Cross-site Scripting | critical | 9.0 | 1% |
| CVE-2021-25041 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_bre | medium | 6.1 | 1% |
| CVE-2021-39334 | job-board-vanilla (WordPress plugin) | The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via | medium | 5.5 | 1% |
| CVE-2021-39335 | wpgenious-job-listing (WordPress plugin) | The WpGenius Job Listing WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization | medium | 5.5 | 1% |
| CVE-2021-39336 | job-manager (WordPress plugin) | The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via seve | medium | 5.5 | 1% |
| CVE-2021-39337 | job-portal (WordPress plugin) | The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via sever | medium | 5.5 | 1% |
| CVE-2022-0930 | microweber/microweber | Cross-site Scripting in microweber | medium | 4.8 | 1% |
| CVE-2023-2224 | seo (WordPress plugin) | The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2020-5298 | october/backend | Reflected XSS when importing CSV in OctoberCMS | medium | 4.0 | 1% |
| CVE-2015-3257 | zendframework/zend-diactoros | zend-diactoros Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2023-5558 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a R | medium | 6.1 | 1% |
| CVE-2022-2060 | dolibarr/dolibarr | Cross site scripting in dolibarr | medium | 5.4 | 1% |
| CVE-2015-9502 | auberge-theme (WordPress theme) | The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier. | medium | 6.1 | 1% |
| CVE-2015-9503 | modern-theme (WordPress theme) | The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier. | medium | 6.1 | 1% |
| CVE-2017-18599 | pinfinity (WordPress theme) | The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter. | medium | 6.1 | 1% |
| CVE-2017-18606 | avada (WordPress theme) | The avada theme before 5.1.5 for WordPress has stored XSS. | medium | 6.1 | 1% |
| CVE-2020-36172 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading t | medium | 6.1 | 1% |
| CVE-2022-1005 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, | medium | 6.1 | 1% |
| CVE-2022-1269 | fastflow (WordPress plugin) | The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an ad | medium | 6.1 | 1% |
| CVE-2019-7411 | launcher (WordPress plugin) | Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject | medium | 5.4 | 1% |
| CVE-2021-4139 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.6 | 1% |
| CVE-2022-30596 | moodle/moodle | Cross-site Scripting in moodle | medium | 5.4 | 1% |
| CVE-2017-18519 | customer-area (WordPress plugin) | The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages. | medium | 6.1 | 1% |
| CVE-2017-18522 | eelv-newsletter (WordPress plugin) | The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book. | medium | 6.1 | 1% |
| CVE-2017-18524 | football-pool (WordPress plugin) | The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18525 | megamenu (WordPress plugin) | The megamenu plugin before 2.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18526 | moreads-se (WordPress plugin) | The moreads-se plugin before 1.4.7 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18531 | raygun4wp (WordPress plugin) | The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288. | medium | 6.1 | 1% |
| CVE-2017-18533 | rimons-twitter-widget (WordPress plugin) | The rimons-twitter-widget plugin before 1.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18534 | share-on-diaspora (WordPress plugin) | The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters. | medium | 6.1 | 1% |
| CVE-2017-18535 | smokesignal (WordPress plugin) | The smokesignal plugin before 1.2.7 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18553 | ad-buttons (WordPress plugin) | The ad-buttons plugin before 2.3.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18554 | analytics-tracker (WordPress plugin) | The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event. | medium | 6.1 | 1% |
| CVE-2017-18555 | booking-sms (WordPress plugin) | The booking-sms plugin before 1.1.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18560 | content-audit (WordPress plugin) | The content-audit plugin before 1.9.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18561 | embed-comment-images (WordPress plugin) | The embed-comment-images plugin before 0.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18563 | rsvp (WordPress plugin) | The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen. | medium | 6.1 | 1% |
| CVE-2017-18567 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.4.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18568 | my-wp-translate (WordPress plugin) | The my-wp-translate plugin before 1.0.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18576 | event-notifier (WordPress plugin) | The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation. | medium | 6.1 | 1% |
| CVE-2017-18577 | mailchimp-for-wp (WordPress plugin) | The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg. | medium | 6.1 | 1% |
| CVE-2017-18578 | crafty-social-buttons (WordPress plugin) | The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS. | medium | 6.1 | 1% |