Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2009-4159 | directmailteam/direct-mail | TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS) | low | 0.0 | 1% |
| CVE-2023-3084 | nilsteampassnet/teampass | TeamPass vulnerable to stored Cross-site Scripting | high | 8.1 | 1% |
| CVE-2018-10125 | contao/contao, contao/core, contao/core-bundle | Cross-site Scripting in Contao | medium | 6.1 | 1% |
| CVE-2017-8384 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2019-17496 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-0964 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2024-13627 | owl-carousel-slider (WordPress plugin) | The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 4.7 | 1% |
| CVE-2022-35587 | forkcms/forkcms | ForkCMS XSS via `publish_on_date` parameter | medium | 4.8 | 1% |
| CVE-2017-8052 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-26144 | mantisbt/mantisbt | MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php | medium | 6.1 | 1% |
| CVE-2022-3144 | wordfence (WordPress plugin) | The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and inc | medium | 4.4 | 1% |
| CVE-2011-4903 | typo3/cms | Typo3 XSS in RemoveXSS function | medium | 6.1 | 1% |
| CVE-2021-25006 | molie-instructure-canvas-linking-tool (WordPress plugin) | The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to | medium | 6.1 | 1% |
| CVE-2022-3402 | log-http-requests (WordPress plugin) | The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and incl | medium | 6.1 | 1% |
| CVE-2022-38467 | crm-perks-forms (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver. | medium | 6.1 | 1% |
| CVE-2021-26256 | survey-maker (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6). | medium | 4.7 | 1% |
| CVE-2009-4963 | commerceteam/commerce | Commerce extension for TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2017-11516 | yiisoft/yii2, yiisoft/yii2-dev | Yii Cross-site Scripting Framework vulnerability | medium | 6.1 | 1% |
| CVE-2018-11200 | mautic/core | XSS vulnerability in company name field in Mautic | medium | 6.1 | 1% |
| CVE-2013-0286 | pinboard (WordPress theme) | Pinboard 1.0.6 theme for Wordpress has XSS. | medium | 5.4 | 1% |
| CVE-2020-13828 | dolibarr/dolibarr | Dolibarr stored Cross-Site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2022-30874 | nukeviet/nukeviet | Cross-site Scripting in NukeViet CMS | medium | 5.4 | 1% |
| CVE-2023-24814 | typo3/cms, typo3/cms-core | TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering | high | 8.8 | 1% |
| CVE-2022-4214 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page | medium | 6.1 | 1% |
| CVE-2023-43875 | intelliants/subrion | Subrion CMS vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2021-3879 | snipe/snipe-it | Cross-site Scripting in snipe-it | medium | 6.8 | 1% |
| CVE-2020-36171 | elementor (WordPress plugin) | The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads. | medium | 6.1 | 1% |
| CVE-2022-2925 | appwrite/server-ce | Appwrite Vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-3135 | newspaper (WordPress theme) | An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id para | medium | 6.1 | 1% |
| CVE-2021-24325 | seo-redirection-plugin (WordPress plugin) | The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scrip | medium | 6.1 | 1% |
| CVE-2021-24362 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a | medium | 6.1 | 1% |
| CVE-2021-24368 | quiz-and-survey-master (WordPress plugin) | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id param | medium | 6.1 | 1% |
| CVE-2021-24372 | wp-hardening (WordPress plugin) | The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before o | medium | 6.1 | 1% |
| CVE-2021-24373 | wp-hardening (WordPress plugin) | The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter befor | medium | 6.1 | 1% |
| CVE-2021-24437 | favicon-by-realfavicongenerator (WordPress plugin) | The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it ba | medium | 6.1 | 1% |
| CVE-2021-24438 | dashboard-for-google-analytics (WordPress plugin) | The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stat | medium | 6.1 | 1% |
| CVE-2021-24496 | community-events (WordPress plugin) | The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET para | medium | 6.1 | 1% |
| CVE-2021-24578 | sportspress (WordPress plugin) | The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events back | medium | 6.1 | 1% |
| CVE-2021-24588 | sms-alert-order-notifications (WordPress plugin) | The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's se | medium | 6.1 | 1% |
| CVE-2021-24632 | recipe-card-blocks-for-gutenberg-\&-elementor (WordPress plugin) | The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin | medium | 6.1 | 1% |
| CVE-2021-24676 | better-find-and-replace (WordPress plugin) | The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Ru | medium | 6.1 | 1% |
| CVE-2021-24679 | bitcoin-\/-altcoin-payment-gateway-for-woocommerce (WordPress plugin) | The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting | medium | 6.1 | 1% |
| CVE-2021-24697 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sd | medium | 6.1 | 1% |
| CVE-2021-24798 | wp-header-images (WordPress plugin) | The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's se | medium | 6.1 | 1% |
| CVE-2021-24924 | email-log (WordPress plugin) | The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leadi | medium | 6.1 | 1% |
| CVE-2021-24932 | auto-featured-image (WordPress plugin) | The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before output | medium | 6.1 | 1% |
| CVE-2021-24939 | loginwp (WordPress plugin) | The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_ | medium | 6.1 | 1% |
| CVE-2021-24941 | icegram (WordPress plugin) | The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id paramet | medium | 6.1 | 1% |
| CVE-2021-24980 | gwolle-guestbook (WordPress plugin) | The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back | medium | 6.1 | 1% |
| CVE-2021-24984 | wpfront-user-role-editor (WordPress plugin) | The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting | medium | 6.1 | 1% |