Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1001 | wp-downgrade (WordPress plugin) | The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not | medium | 4.8 | 5% |
| CVE-2022-4407 | thorsten/phpmyfaq | phpMyFAQ vulnerable to Cross-site Scripting | medium | 6.1 | 5% |
| CVE-2022-35653 | moodle/moodle | Moodle LTI module reflected XSS risk | medium | 6.1 | 5% |
| CVE-2022-34140 | feehi/cms | Feehi CMS Cross-site Scripting | medium | 5.4 | 5% |
| CVE-2017-15374 | shopware/shopware | Shopware XSS Vulnerability | medium | 6.1 | 5% |
| CVE-2021-24247 | contact-form-check-tester (WordPress plugin) | The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking a | medium | 5.4 | 5% |
| CVE-2014-3544 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 5% |
| CVE-2016-1000131 | e-search (WordPress plugin) | Reflected XSS in wordpress plugin e-search v1.0 | medium | 6.1 | 5% |
| CVE-2016-1000134 | hdw-tube (WordPress plugin) | Reflected XSS in wordpress plugin hdw-tube v1.2 | medium | 6.1 | 5% |
| CVE-2016-1000135 | hdw-tube (WordPress plugin) | Reflected XSS in wordpress plugin hdw-tube v1.2 | medium | 6.1 | 5% |
| CVE-2019-16172 | limesurvey/limesurvey | Cross-site Scripting in LimeSurvey | medium | 5.4 | 5% |
| CVE-2019-16117 | photo-gallery (WordPress plugin) | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.p | medium | 6.1 | 5% |
| CVE-2013-7319 | download-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitra | medium | 4.3 | 5% |
| CVE-2014-4513 | activehelper-livehelp-live-chat (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier fo | medium | 4.3 | 5% |
| CVE-2013-1409 | commentluv (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | 5% |
| CVE-2015-4084 | free-counter (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script | medium | 4.3 | 5% |
| CVE-2014-3842 | imember360 (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to | medium | 4.3 | 5% |
| CVE-2016-1000153 | tidio-gallery (WordPress plugin) | Reflected XSS in wordpress plugin tidio-gallery v1.1 | medium | 6.1 | 4% |
| CVE-2016-1000155 | wpsolr-search-engine (WordPress plugin) | Reflected XSS in wordpress plugin wpsolr-search-engine v7.6 | medium | 6.1 | 4% |
| CVE-2019-11869 | yuzo (WordPress plugin) | The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes fr | medium | 6.1 | 4% |
| CVE-2018-19799 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 4% |
| CVE-2022-24899 | contao/contao, contao/core-bundle | Cross site scripting via canonical tag in Contao | high | 7.2 | 4% |
| CVE-2012-1188 | forkcms/forkcms | Fork CMS Multiple XSS Vulnerabilities | medium | 0.0 | 4% |
| CVE-2020-11930 | gtranslate (WordPress plugin) | The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature withi | medium | 6.1 | 4% |
| CVE-2021-24329 | wp-super-cache (WordPress plugin) | The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead | medium | 5.4 | 4% |
| CVE-2016-1000137 | hero-maps-pro (WordPress plugin) | Reflected XSS in wordpress plugin hero-maps-pro v2.1.0 | medium | 6.1 | 4% |
| CVE-2016-1000142 | parsi-font (WordPress plugin) | Reflected XSS in wordpress plugin parsi-font v4.2.5 | medium | 6.1 | 4% |
| CVE-2020-10385 | wpforms-lite (WordPress plugin) | A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress. | medium | 5.4 | 4% |
| CVE-2016-1000132 | enhanced-tooltipglossary (WordPress plugin) | Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8 | medium | 6.1 | 4% |
| CVE-2015-7377 | pie-register (WordPress plugin) | Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remo | medium | 4.3 | 4% |
| CVE-2018-7747 | caldera-forms (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to in | medium | 4.8 | 4% |
| CVE-2022-0750 | photoswipe-masonry (WordPress plugin) | The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the t | medium | 6.4 | 4% |
| CVE-2007-5105 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web scrip | medium | 4.3 | 4% |
| CVE-2020-26153 | event-espresso (WordPress plugin) | A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overvie | medium | 6.1 | 4% |
| CVE-2022-0210 | random-banner (WordPress plugin) | The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter foun | medium | 4.8 | 4% |
| CVE-2018-14041 | twbs/bootstrap, typo3/cms, typo3/cms-core | Bootstrap Cross-site Scripting vulnerability | medium | 6.1 | 4% |
| CVE-2018-10102 | WordPress core | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag. | medium | 6.1 | 4% |
| CVE-2018-20150 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. | medium | 6.1 | 4% |
| CVE-2014-4558 | swipehq-payment-gateway-woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress all | medium | 6.1 | 4% |
| CVE-2016-1000128 | anti-plagiarism (WordPress plugin) | Reflected XSS in wordpress plugin anti-plagiarism v3.60 | medium | 6.1 | 4% |
| CVE-2016-1000139 | infusionsoft (WordPress plugin) | Reflected XSS in wordpress plugin infusionsoft v1.5.11 | medium | 6.1 | 4% |
| CVE-2015-2218 | wonderplugin-audio-player (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Pla | medium | 4.3 | 4% |
| CVE-2015-4465 | zm-ajax-login-register (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject | medium | 4.3 | 4% |
| CVE-2016-1000152 | tidio-form (WordPress plugin) | Reflected XSS in wordpress plugin tidio-form v1.0 | medium | 6.1 | 4% |
| CVE-2014-6312 | login-sidebar-widget (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before 3.2.1 for WordPress | medium | 4.3 | 4% |
| CVE-2018-14040 | twbs/bootstrap | Bootstrap vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 4% |
| CVE-2012-2572 | threewp-email-reflector (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject a | medium | 4.3 | 4% |
| CVE-2021-24581 | blue-admin (WordPress plugin) | The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading t | high | 8.8 | 4% |
| CVE-2013-5978 | cart66-lite (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote att | medium | 6.1 | 4% |
| CVE-2021-27909 | mautic/core | XSS vulnerability on password reset page | medium | 6.3 | 4% |