Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1351 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 6.8 | 1% |
| CVE-2022-0893 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2022-0911 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2022-23980 | yet-another-stars-rating (WordPress plugin) | Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at p | medium | 4.7 | 1% |
| CVE-2021-43678 | gaoming13/wechat-php-sdk | Wechat-php-sdk is affected by a Cross Site Scripting vulnerability. | medium | 6.1 | 1% |
| CVE-2023-23927 | craftcms/cms | Craft CMS Stored Cross-site Scripting Injection Vulnerability | medium | 6.1 | 1% |
| CVE-2024-3753 | hostel (WordPress plugin) | The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 5.9 | 1% |
| CVE-2018-0577 | wp-google-map-plugin (WordPress plugin) | Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary | medium | 5.4 | 1% |
| CVE-2021-24333 | content-copy-protection-\&-prevent-image-save (WordPress plugin) | The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform | medium | 6.5 | 1% |
| CVE-2021-24764 | perfect-survey (WordPress plugin) | The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[session_id] of single_stat | medium | 6.1 | 1% |
| CVE-2021-24874 | newsletter\,-smtp\,-email-marketing-and-subscribe (WordPress plugin) | The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid para | medium | 6.1 | 1% |
| CVE-2021-24909 | acf-photo-gallery-field (WordPress plugin) | The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_ | medium | 6.1 | 1% |
| CVE-2021-24921 | advanced-database-cleaner (WordPress plugin) | The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back i | medium | 6.1 | 1% |
| CVE-2021-24953 | advanced-iframe (WordPress plugin) | The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an adm | medium | 6.1 | 1% |
| CVE-2021-24986 | post-grid (WordPress plugin) | The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a R | medium | 6.1 | 1% |
| CVE-2021-24996 | idpay-for-contact-form-7 (WordPress plugin) | The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back | medium | 6.1 | 1% |
| CVE-2021-25012 | pz-linkcard (WordPress plugin) | The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashb | medium | 6.1 | 1% |
| CVE-2021-25019 | seo-plugin-by-squirrly-seo (WordPress plugin) | The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute | medium | 6.1 | 1% |
| CVE-2021-25034 | wp-user (WordPress plugin) | The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading | medium | 6.1 | 1% |
| CVE-2021-25038 | multisite-user-sync\/unsync (WordPress plugin) | The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per | medium | 6.1 | 1% |
| CVE-2021-25039 | multisite-content-copier\/updater (WordPress plugin) | The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source | medium | 6.1 | 1% |
| CVE-2021-25047 | 10websocial (WordPress plugin) | The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_a | medium | 6.1 | 1% |
| CVE-2021-25071 | akismet-privacy-policies (WordPress plugin) | The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leadin | medium | 6.1 | 1% |
| CVE-2021-25089 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before ou | medium | 6.1 | 1% |
| CVE-2021-25091 | link-library (WordPress plugin) | The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting it back in an admin | medium | 6.1 | 1% |
| CVE-2021-46780 | easy-google-maps (WordPress plugin) | The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin | medium | 6.1 | 1% |
| CVE-2021-46781 | coming-soon (WordPress plugin) | The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an at | medium | 6.1 | 1% |
| CVE-2021-46782 | price-table (WordPress plugin) | The Pricing Table by Supsystic WordPress plugin before 1.9.5 does not escape the tab parameter before outputting it back in an attribute in | medium | 6.1 | 1% |
| CVE-2022-0314 | nimble-page-builder (WordPress plugin) | The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it bac | medium | 6.1 | 1% |
| CVE-2022-0347 | loginpress (WordPress plugin) | The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting i | medium | 6.1 | 1% |
| CVE-2022-0428 | content-egg (WordPress plugin) | The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the | medium | 6.1 | 1% |
| CVE-2022-0449 | flexi (WordPress plugin) | The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the | medium | 6.1 | 1% |
| CVE-2022-0503 | multisite-content-copier\/updater (WordPress plugin) | The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting | medium | 6.1 | 1% |
| CVE-2022-0531 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back | medium | 6.1 | 1% |
| CVE-2022-0600 | conference-scheduler (WordPress plugin) | The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin pag | medium | 6.1 | 1% |
| CVE-2022-0619 | database-peek (WordPress plugin) | The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, | medium | 6.1 | 1% |
| CVE-2022-0620 | delete-old-orders (WordPress plugin) | The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin pag | medium | 6.1 | 1% |
| CVE-2022-0621 | dtabs (WordPress plugin) | The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to | medium | 6.1 | 1% |
| CVE-2022-0625 | admin-menu-editor (WordPress plugin) | The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, le | medium | 6.1 | 1% |
| CVE-2022-0627 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leadin | medium | 6.1 | 1% |
| CVE-2022-0641 | popup-like-box (WordPress plugin) | The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin | medium | 6.1 | 1% |
| CVE-2022-0643 | bank-mellat (WordPress plugin) | The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page | medium | 6.1 | 1% |
| CVE-2022-0648 | team-circle-image-slider-with-lightbox (WordPress plugin) | The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before output | medium | 6.1 | 1% |
| CVE-2022-0892 | export-all-urls (WordPress plugin) | The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading | medium | 6.1 | 1% |
| CVE-2022-1009 | smush-image-compression-and-optimization (WordPress plugin) | The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page wh | medium | 6.1 | 1% |
| CVE-2022-1047 | post-type-builder-search-addon (WordPress plugin) | The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in | medium | 6.1 | 1% |
| CVE-2022-1171 | vertical-scroll-recent-post (WordPress plugin) | The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attrib | medium | 6.1 | 1% |
| CVE-2022-1216 | advanced-image-sitemap (WordPress plugin) | The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in | medium | 6.1 | 1% |
| CVE-2022-1217 | custom-tinymce-shortcode-button (WordPress plugin) | The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it bac | medium | 6.1 | 1% |
| CVE-2022-1218 | domain-replace (WordPress plugin) | The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an a | medium | 6.1 | 1% |