Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-38329 | dj-email-publish (WordPress plugin) | The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/ | medium | 6.1 | 1% |
| CVE-2021-38331 | wp-t-wap (WordPress plugin) | The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file wh | medium | 6.1 | 1% |
| CVE-2021-38332 | ops-robots-txt (WordPress plugin) | The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER[" | medium | 6.1 | 1% |
| CVE-2021-38334 | wp-design-maps-places (WordPress plugin) | The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp | medium | 6.1 | 1% |
| CVE-2021-38335 | wiseagentleadform (WordPress plugin) | The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value | medium | 6.1 | 1% |
| CVE-2021-38336 | edit-comments-xt (WordPress plugin) | The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~ | medium | 6.1 | 1% |
| CVE-2021-38337 | rsvpmaker-excel (WordPress plugin) | The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/ | medium | 6.1 | 1% |
| CVE-2021-38338 | border-loading-bar (WordPress plugin) | The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-f | medium | 6.1 | 1% |
| CVE-2021-38339 | simple-matted-thumbnails (WordPress plugin) | The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value | medium | 6.1 | 1% |
| CVE-2021-38340 | webful-simple-grocery-shop (WordPress plugin) | The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/inclu | medium | 6.1 | 1% |
| CVE-2021-38348 | advance-search (WordPress plugin) | The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views | medium | 6.1 | 1% |
| CVE-2021-38349 | woo-moneybird (WordPress plugin) | The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description para | medium | 6.1 | 1% |
| CVE-2021-38350 | spideranalyse (WordPress plugin) | The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php f | medium | 6.1 | 1% |
| CVE-2021-38351 | osd-subscribe (WordPress plugin) | The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/op | medium | 6.1 | 1% |
| CVE-2021-38352 | push-notification-by-feedify (WordPress plugin) | The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in | medium | 6.1 | 1% |
| CVE-2021-38353 | dropdown-and-scrollable-text (WordPress plugin) | The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/i | medium | 6.1 | 1% |
| CVE-2021-38354 | gnu-mailman-integration (WordPress plugin) | The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/inclu | medium | 6.1 | 1% |
| CVE-2022-2407 | wp-phpmyadmin (WordPress plugin) | The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2021-25955 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | critical | 9.0 | 1% |
| CVE-2022-2890 | yetiforce/yetiforce-crm | Cross site scripting in yetiforce/yetiforce-crm | medium | 5.4 | 1% |
| CVE-2021-24681 | duplicate-page (WordPress plugin) | The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which | medium | 4.8 | 1% |
| CVE-2019-11876 | prestashop/prestashop | PrestaShop Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2020-14959 | easy-testimonials (WordPress plugin) | Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script | medium | 5.4 | 1% |
| CVE-2020-14962 | image-photo-gallery-final-tiles-grid (WordPress plugin) | Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web sc | medium | 5.4 | 1% |
| CVE-2018-16514 | mantisbt/mantisbt | MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO | medium | 6.1 | 1% |
| CVE-2024-9458 | reservit-hotel (WordPress plugin) | The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2017-18539 | weblibrarian (WordPress plugin) | The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes. | medium | 6.1 | 1% |
| CVE-2021-24724 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low | medium | 5.4 | 1% |
| CVE-2021-25015 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page | medium | 6.1 | 1% |
| CVE-2021-25031 | image-hover-effects-ultimate (WordPress plugin) | The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape t | medium | 6.1 | 1% |
| CVE-2021-25035 | backup-and-staging-by-wp-time-capsule (WordPress plugin) | The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting | medium | 6.1 | 1% |
| CVE-2021-25062 | orders-tracking-for-woocommerce (WordPress plugin) | The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an | medium | 6.1 | 1% |
| CVE-2021-25083 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an | medium | 6.1 | 1% |
| CVE-2023-28665 | bulk-price-update-for-woocommerce (WordPress plugin) | The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' | medium | 5.4 | 1% |
| CVE-2022-1029 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with a | medium | 4.8 | 1% |
| CVE-2020-26225 | prestashop/productcomments | Reflected XSS with parameters in PostComment | high | 8.7 | 1% |
| CVE-2018-16255 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vu | medium | 6.1 | 1% |
| CVE-2018-16258 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that th | medium | 6.1 | 1% |
| CVE-2018-16259 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states | medium | 6.1 | 1% |
| CVE-2019-14947 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. | medium | 5.4 | 1% |
| CVE-2021-34653 | wp-fountain (WordPress plugin) | The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/wp-fountain | medium | 6.1 | 1% |
| CVE-2022-0951 | showdoc/showdoc | File Upload Restriction Bypass leading to Cross-site Scripting in ShowDoc | medium | 6.1 | 1% |
| CVE-2024-33298 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 0.0 | 1% |
| CVE-2015-10073 | tinymighty/wiki-seo | tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function | critical | 9.6 | 1% |
| CVE-2019-12205 | silverstripe/admin, silverstripe/framework | Silverstripe Flash Clipboard Reflected XSS | medium | 6.1 | 1% |
| CVE-2011-1150 | bbpress/bbpress | bbPress Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2019-14945 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 2.0.54 for WordPress has XSS. | medium | 5.4 | 1% |
| CVE-2021-24720 | geodirectory (WordPress plugin) | The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS). | medium | 5.4 | 1% |
| CVE-2022-4208 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' pa | medium | 6.1 | 1% |
| CVE-2022-4209 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' | medium | 6.1 | 1% |