Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-25040 | booking-calendar (WordPress plugin) | The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an a | medium | 6.1 | 1% |
| CVE-2021-24290 | store-locator-plus (WordPress plugin) | There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the abi | medium | 6.1 | 1% |
| CVE-2021-20183 | moodle/moodle | Moodle Vulnerable to Reflected Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-43808 | illuminate/view, laravel/framework | Laravel Framework XSS in Blade templating engine | medium | 6.1 | 1% |
| CVE-2022-36020 | typo3/cms, typo3/cms-core, typo3/html-sanitizer | TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection | medium | 6.1 | 1% |
| CVE-2017-7298 | moodle/moodle | Moodle Cross-site Scripting in the Course summary filter of the Add a new course | medium | 5.4 | 1% |
| CVE-2023-2009 | pretty-url (WordPress plugin) | Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privileg | medium | 4.8 | 1% |
| CVE-2024-6753 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poste | high | 7.2 | 1% |
| CVE-2022-3255 | pimcore/pimcore | Pimcore vulnerable to cross site scripting | medium | 6.8 | 1% |
| CVE-2012-20001 | prestashop/prestashop | PrestaShop XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2021-24297 | goto (WordPress plugin) | The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an | medium | 6.1 | 1% |
| CVE-2021-24925 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_li | medium | 6.1 | 1% |
| CVE-2021-24938 | woocommerce-currency-switcher (WordPress plugin) | The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (avai | medium | 6.1 | 1% |
| CVE-2021-24136 | testimonials-widget (WordPress plugin) | Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Sit | medium | 5.4 | 1% |
| CVE-2020-4061 | october/backend | Cross-site Scripting in October | low | 3.7 | 1% |
| CVE-2021-39202 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | high | 7.6 | 1% |
| CVE-2018-18919 | wp-editor.md (WordPress plugin) | The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area. | medium | 4.8 | 1% |
| CVE-2022-25617 | code-snippets (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter. | medium | 4.7 | 1% |
| CVE-2021-34660 | wp-fusion-lite (WordPress plugin) | The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admi | medium | 6.1 | 1% |
| CVE-2021-38359 | refer-a-friend-widget-for-wp (WordPress plugin) | The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the | medium | 6.1 | 1% |
| CVE-2022-0946 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2012-4579 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple XSS Vulnerabilities | low | 0.0 | 1% |
| CVE-2019-17576 | dolibarr/dolibarr | Dolibarr Cross-site Scripting via outgoing email setup feature | medium | 5.4 | 1% |
| CVE-2019-17577 | dolibarr/dolibarr | Dolibarr Cross-site Scripting via outgoing email setup feature | medium | 5.4 | 1% |
| CVE-2019-17578 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-23921 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-2092 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possib | medium | 6.1 | 1% |
| CVE-2022-35585 | forkcms/forkcms | ForkCMS stored XSS via `start_date` parameter | medium | 4.8 | 1% |
| CVE-2022-0253 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-0737 | text-hover (WordPress plugin) | The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform | medium | 4.8 | 1% |
| CVE-2017-16880 | filp/whoops | filp whoops Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2018-8071 | mautic/core | XSS vulnerability in theme config file in Mautic | medium | 6.1 | 1% |
| CVE-2023-0377 | scriptless-social-sharing (WordPress plugin) | The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them ba | medium | 5.4 | 1% |
| CVE-2020-14475 | dolibarr/dolibarr | Dolibarr reflected cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-24923 | newsletter\,-smtp\,-email-marketing-and-subscribe (WordPress plugin) | The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-da | medium | 6.1 | 1% |
| CVE-2021-25024 | eventcalendar (WordPress plugin) | The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflect | medium | 6.1 | 1% |
| CVE-2021-4222 | wp-paginate (WordPress plugin) | The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2022-0945 | showdoc/showdoc | Stored Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2021-33563 | phanan/koel | Improper rate limiting in Koel | high | 0.0 | 1% |
| CVE-2021-4107 | yetiforce/yetiforce-crm | yetiforcecrm is vulnerable to Cross-site Scripting | medium | 5.3 | 1% |
| CVE-2021-41258 | getkirby/cms | Cross-site scripting (XSS) from image block content in the site frontend | medium | 5.4 | 1% |
| CVE-2023-7246 | system-dashboard (WordPress plugin) | The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multis | medium | 5.4 | 1% |
| CVE-2020-27850 | wp-premium/gravityforms | Gravity Forms stored Cross-Site Scripting (XSS) vulnerability | medium | 4.8 | 1% |
| CVE-2022-3392 | wp-humans.txt (WordPress plugin) | The WP Humans.txt WordPress plugin through 1.0.6 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2017-6213 | paypal/invoice-sdk-php | paypal/invoice-sdk-php reflected XSS | medium | 5.4 | 1% |
| CVE-2017-6215 | paypal/permissions-sdk-php | paypal/permissions-sdk-php reflected Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2018-5362 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php. | medium | 4.8 | 1% |
| CVE-2018-5364 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/option | medium | 4.8 | 1% |
| CVE-2018-5367 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php. | medium | 4.8 | 1% |
| CVE-2021-24883 | popup-anything (WordPress plugin) | The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with | medium | 5.4 | 1% |