Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-15483 | bolt/bolt | Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log | medium | 6.1 | 1% |
| CVE-2019-15484 | bolt/bolt | Bolt Cross-site Scripting (XSS) via an image's alt or title field | medium | 6.1 | 1% |
| CVE-2019-15485 | bolt/bolt | Cross-site Scripting in Bolt | medium | 6.1 | 1% |
| CVE-2021-28145 | concrete5/concrete5 | Concrete CMS Cross-site Scripting via Survey Blocks | medium | 5.4 | 1% |
| CVE-2022-1267 | bmi-bmr-calculator (WordPress plugin) | The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the respon | medium | 6.1 | 1% |
| CVE-2025-51502 | microweber/microweber | Microweber has Reflected XSS Vulnerability in the layout Parameter | medium | 6.1 | 1% |
| CVE-2020-20633 | gdpr-cookie-consent (WordPress plugin) | ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) | medium | 5.4 | 1% |
| CVE-2021-32106 | icecoder/icecoder | Cross-site scripting in ICEcoder | medium | 5.4 | 1% |
| CVE-2022-31290 | idno/known | Known v1.3.1 Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2018-20755 | modx/revolution | MODX Revolution vulnerable to XSS attack through its User Photo field | medium | 6.1 | 1% |
| CVE-2018-20756 | modx/revolution | MODX Revolution allows XSS via document resources | medium | 6.1 | 1% |
| CVE-2018-20757 | modx/revolution | MODX Revolution allows XSS through extended user fields | medium | 6.1 | 1% |
| CVE-2015-2324 | photo-gallery (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authentica | medium | 5.4 | 1% |
| CVE-2022-42097 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 1% |
| CVE-2022-0379 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2022-0232 | custom-landing-pages-leadmagic (WordPress plugin) | The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via | medium | 4.8 | 1% |
| CVE-2018-19280 | centreon/centreon | Centreon XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2021-24599 | email-encoder (WordPress plugin) | The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a | medium | 6.1 | 1% |
| CVE-2023-23922 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-0960 | showdoc/showdoc | Cross-site Scripting in showdoc/showdoc | critical | 9.0 | 1% |
| CVE-2022-1584 | microweber/microweber | Cross-site Scripting in Microweber | medium | 6.3 | 1% |
| CVE-2021-36150 | silverstripe/admin | Cross-site Scripting in SilverStripe Framework | medium | 6.1 | 1% |
| CVE-2020-9016 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2023-0514 | membership-database (WordPress plugin) | The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 1% |
| CVE-2023-0948 | japanized-for-woocommerce (WordPress plugin) | The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to | medium | 6.1 | 1% |
| CVE-2023-1546 | mycryptocheckout (WordPress plugin) | The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cros | medium | 6.1 | 1% |
| CVE-2022-1474 | wp-event-manager (WordPress plugin) | The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the | medium | 6.1 | 1% |
| CVE-2022-1532 | woocommerce-product-filter (WordPress plugin) | Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin | medium | 6.1 | 1% |
| CVE-2022-1604 | mailerlite-signup-forms (WordPress plugin) | The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2020-19626 | craftcms/cms | Craft CMS Cross-site Scripting Vulnerability | medium | 5.4 | 1% |
| CVE-2019-10118 | snipe/snipe-it | Snipe-IT XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2020-35946 | all-in-one-seo-pack (WordPress plugin) | An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to | medium | 5.4 | 1% |
| CVE-2022-0575 | librenms/librenms | Cross-site Scripting in librenms | medium | 5.4 | 1% |
| CVE-2022-0589 | librenms/librenms | Cross-site Scripting in librenms | medium | 5.4 | 1% |
| CVE-2022-1380 | snipe/snipe-it | Cross-site Scripting in snipe-it | medium | 5.4 | 1% |
| CVE-2019-12139 | ezsystems/ezplatform-admin-ui | ezplatform-admin-ui Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2019-7877 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2023-4148 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attr | medium | 6.1 | 1% |
| CVE-2022-21648 | latte/latte | Sandbox bypass in Latte templates | high | 8.2 | 1% |
| CVE-2018-17946 | slideshow-gallery (WordPress plugin) | The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupda | medium | 6.1 | 1% |
| CVE-2020-23263 | forkcms/forkcms | Cross-site scripting in forkcms | medium | 6.1 | 1% |
| CVE-2020-6578 | zencart/zencart | Reflected XSS in Zen Cart before 1.5.7a | medium | 6.1 | 1% |
| CVE-2021-34652 | media-usage (WordPress plugin) | The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allo | medium | 6.1 | 1% |
| CVE-2021-34655 | wp-songbook (WordPress plugin) | The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the ~/inc/class.ajax.php fil | medium | 6.1 | 1% |
| CVE-2021-34657 | typofr (WordPress plugin) | The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the ~/vendor/Org_Heigl/Hyphenato | medium | 6.1 | 1% |
| CVE-2021-34665 | wp-seo-tags (WordPress plugin) | The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saq_txt_the_filter parameter in the ~/wp-seo-tags.p | medium | 6.1 | 1% |
| CVE-2021-34666 | sidebar-adder (WordPress plugin) | The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file whic | medium | 6.1 | 1% |
| CVE-2022-24746 | shopware/core, shopware/platform, shopware/storefront | HTML injection possibility in voucher code form in Shopware | medium | 6.1 | 1% |
| CVE-2017-1000488 | mautic/core | Inline JS XSS vulnerability in Mautic | medium | 6.1 | 1% |
| CVE-2018-0574 | baserproject/basercms | XSS in baserCMS | medium | 6.1 | 1% |