Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-18579 | corner-ad (WordPress plugin) | The corner-ad plugin before 1.0.8 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18581 | time-sheets (WordPress plugin) | The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list. | medium | 6.1 | 1% |
| CVE-2017-18582 | time-sheets (WordPress plugin) | The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18591 | gd-rating-system (WordPress plugin) | The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php. | medium | 6.1 | 1% |
| CVE-2018-11198 | mautic/core | XSS vulnerability in Author URL of themes in Mautic | medium | 6.1 | 1% |
| CVE-2018-11317 | intelliants/subrion | Subrion CMS XSS | medium | 6.1 | 1% |
| CVE-2018-16254 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vul | medium | 6.1 | 1% |
| CVE-2018-20978 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.4.7 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2018-20983 | wp-retina-2x (WordPress plugin) | The wp-retina-2x plugin before 5.2.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2018-21001 | anycomment (WordPress plugin) | The anycomment plugin before 0.0.33 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2020-35037 | events-manager (WordPress plugin) | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which co | medium | 6.1 | 1% |
| CVE-2021-24885 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Ref | medium | 6.1 | 1% |
| CVE-2021-25027 | powerpack-addons-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute | medium | 6.1 | 1% |
| CVE-2021-39325 | optinmonster (WordPress plugin) | The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews | medium | 6.1 | 1% |
| CVE-2022-1208 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user pr | medium | 6.4 | 1% |
| CVE-2016-10963 | icegram (WordPress plugin) | The icegram plugin before 1.9.19 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10979 | fossura-tag-miner (WordPress plugin) | The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-1000509 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2024-11252 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon | medium | 6.1 | 1% |
| CVE-2024-40101 | microweber/microweber | Microweber Reflected Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2022-0558 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2021-32244 | moodle/moodle | Moodle Cross Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2022-0723 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2022-0962 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-0965 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-2036 | francoisjacquet/rosariosis | Cross site scripting in francoisjacquet/rosariosis | medium | 5.4 | 1% |
| CVE-2010-4183 | ezyang/htmlpurifier | HTML Purifier cross-site scripting (XSS) vulnerability | medium | 0.0 | 1% |
| CVE-2017-15375 | wpjobboard (WordPress plugin) | Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The v | medium | 6.1 | 1% |
| CVE-2018-6466 | flickrrss (WordPress plugin) | A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar | medium | 6.1 | 1% |
| CVE-2018-6468 | flickrrss (WordPress plugin) | A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar | medium | 6.1 | 1% |
| CVE-2018-6469 | flickrrss (WordPress plugin) | A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar | medium | 6.1 | 1% |
| CVE-2016-10112 | woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to | medium | 4.8 | 1% |
| CVE-2022-0233 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to in | medium | 6.4 | 1% |
| CVE-2021-24177 | file-manager (WordPress plugin) | In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php? | medium | 5.4 | 1% |
| CVE-2018-20977 | all-in-one-schemaorg-rich-snippets (WordPress plugin) | The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page. | medium | 6.1 | 1% |
| CVE-2021-34649 | simple-behace-portfolio (WordPress plugin) | The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `dark` parameter in the ~/titan-framew | medium | 6.1 | 1% |
| CVE-2021-34651 | scribble-maps (WordPress plugin) | The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file wh | medium | 6.1 | 1% |
| CVE-2021-34654 | custom-post-type-relations (WordPress plugin) | The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptr[name] parameter found in the ~/ | medium | 6.1 | 1% |
| CVE-2021-34656 | webcam-2way-videochat (WordPress plugin) | The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_n | medium | 6.1 | 1% |
| CVE-2021-34658 | simple-popup-newsletter (WordPress plugin) | The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~ | medium | 6.1 | 1% |
| CVE-2021-34659 | plugmatter-pricing-table (WordPress plugin) | The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `email` parameter in the ~/licens | medium | 6.1 | 1% |
| CVE-2021-34663 | jquery-tagline-rotator (WordPress plugin) | The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/ | medium | 6.1 | 1% |
| CVE-2021-34667 | calendar-plugin (WordPress plugin) | The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calen | medium | 6.1 | 1% |
| CVE-2021-38317 | konnichiwa (WordPress plugin) | The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscri | medium | 6.1 | 1% |
| CVE-2021-38318 | 3d-cover-carousel (WordPress plugin) | The 3D Cover Carousel WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/cover-carousel.php file | medium | 6.1 | 1% |
| CVE-2021-38319 | more-from-google (WordPress plugin) | The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~ | medium | 6.1 | 1% |
| CVE-2021-38321 | custom-sub-menus (WordPress plugin) | The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selected_menu parameter found in the ~/custo | medium | 6.1 | 1% |
| CVE-2021-38322 | twitter-friends-widget (WordPress plugin) | The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmc_TF_user and pmc_TF_password paramete | medium | 6.1 | 1% |
| CVE-2021-38326 | post-title-counter (WordPress plugin) | The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-c | medium | 6.1 | 1% |
| CVE-2021-38328 | notices (WordPress plugin) | The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/notices. | medium | 6.1 | 1% |