Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4210 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page | medium | 6.1 | 1% |
| CVE-2022-4211 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' p | medium | 6.1 | 1% |
| CVE-2022-4212 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page | medium | 6.1 | 1% |
| CVE-2024-24574 | phpmyfaq/phpmyfaq | phpMyFAQ vulnerable to stored XSS on attachments filename | medium | 6.5 | 1% |
| CVE-2022-24563 | genix/cms | Cross-site Scripting in GeniXCMS | medium | 5.4 | 1% |
| CVE-2021-4050 | remdex/livehelperchat | Cross site scripting in remdex/livehelperchat | medium | 6.1 | 1% |
| CVE-2022-0873 | gmedia-gallery (WordPress plugin) | The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts wi | medium | 4.8 | 1% |
| CVE-2021-24648 | registrationmagic (WordPress plugin) | The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in a | medium | 6.1 | 1% |
| CVE-2021-25043 | woocommerce-currency-switcher (WordPress plugin) | The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response | medium | 6.1 | 1% |
| CVE-2021-25077 | store-toolkit-for-woocommerce (WordPress plugin) | The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in | medium | 6.1 | 1% |
| CVE-2022-0161 | ari-fancy-lightbox (WordPress plugin) | The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin pa | medium | 6.1 | 1% |
| CVE-2022-0176 | powerpack-for-beaver-builder (WordPress plugin) | The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it ba | medium | 6.1 | 1% |
| CVE-2022-0193 | complianz (WordPress plugin) | The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, lead | medium | 6.1 | 1% |
| CVE-2022-0399 | advanced-product-labels-for-woocommerce (WordPress plugin) | The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter be | medium | 6.1 | 1% |
| CVE-2022-0431 | insights-from-google-pagespeed (WordPress plugin) | The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back | medium | 6.1 | 1% |
| CVE-2022-0471 | favicon-by-realfavicongenerator (WordPress plugin) | The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter befor | medium | 6.1 | 1% |
| CVE-2022-0601 | countdown\,-coming-soon\,-maintenance---countdown-\&-clock (WordPress plugin) | The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it b | medium | 6.1 | 1% |
| CVE-2022-1282 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back | medium | 6.1 | 1% |
| CVE-2019-15489 | jsdecena/laracom | laracom Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2021-38356 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['p | medium | 6.1 | 1% |
| CVE-2021-43558 | moodle/moodle | Cross-site Scripting in moodle | medium | 6.1 | 1% |
| CVE-2023-38000 | WordPress core, gutenberg (WordPress plugin) | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 t | medium | 6.5 | 1% |
| CVE-2021-21340 | typo3/cms, typo3/cms-backend, typo3/cms-core | Cross-Site Scripting in Content Preview | medium | 5.4 | 1% |
| CVE-2021-21358 | typo3/cms, typo3/cms-core, typo3/cms-form | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form | medium | 5.4 | 1% |
| CVE-2021-21370 | typo3/cms, typo3/cms-backend, typo3/cms-core | Cross-Site Scripting in Content Preview (CType menu) | medium | 5.4 | 1% |
| CVE-2022-0501 | ptrofimov/beanstalk_console | Cross-site Scripting in Beanstalk console | medium | 6.1 | 1% |
| CVE-2022-1571 | facturascripts/facturascripts | Cross-site Scripting in FacturaScripts | medium | 6.1 | 1% |
| CVE-2015-5336 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | medium | 5.4 | 1% |
| CVE-2020-16095 | kitodo/presentation | Cross-site Scripting vulnerability in Kitodo.Presentation | medium | 6.1 | 1% |
| CVE-2021-24293 | nextgen-gallery (WordPress plugin) | In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ | medium | 6.1 | 1% |
| CVE-2024-1985 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up | medium | 4.7 | 1% |
| CVE-2021-28088 | impresscms/impresscms | Cross-site scripting (XSS) | medium | 0.0 | 1% |
| CVE-2021-25100 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms da | medium | 6.1 | 1% |
| CVE-2022-0252 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin d | medium | 6.1 | 1% |
| CVE-2022-0380 | fotobook (WordPress plugin) | The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF | medium | 6.1 | 1% |
| CVE-2022-0628 | ap-mega-menu (WordPress plugin) | The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, | medium | 6.1 | 1% |
| CVE-2022-0640 | pricing-table-builder (WordPress plugin) | The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an ad | medium | 6.1 | 1% |
| CVE-2022-0680 | plezi (WordPress plugin) | The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable op | medium | 6.1 | 1% |
| CVE-2022-0780 | searchiq (WordPress plugin) | The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers acce | medium | 6.1 | 1% |
| CVE-2022-0818 | woocommerce-affiliate (WordPress plugin) | The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, | medium | 6.1 | 1% |
| CVE-2022-23912 | ap-custom-testimonial (WordPress plugin) | The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an | medium | 6.1 | 1% |
| CVE-2020-35933 | newsletter (WordPress plugin) | A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attacke | medium | 6.5 | 1% |
| CVE-2022-3721 | froxlor/froxlor | Froxlor vulnerable to Code Injection | medium | 4.6 | 1% |
| CVE-2018-1000640 | villagedefrance/opencart-overclocked | OpenCart-Overclocked Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2018-16257 | wp-all-import (WordPress plugin) | There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is | medium | 6.1 | 1% |
| CVE-2025-51501 | microweber/microweber | Microweber has Reflected XSS Vulnerability in the id Parameter | medium | 6.1 | 1% |
| CVE-2017-2578 | moodle/moodle | Moodle Cross-site Scripting in assignment submission page | medium | 6.1 | 1% |
| CVE-2022-1465 | wpc-smart-wishlist-for-woocommerce (WordPress plugin) | The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in a | medium | 6.1 | 1% |
| CVE-2022-1527 | wp-2fa (WordPress plugin) | The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a R | medium | 6.1 | 1% |
| CVE-2019-15481 | kevinpapst/kimai2 | Kimai v2 is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |