Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1241 | ask-me (WordPress plugin) | The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Ref | medium | 6.1 | 1% |
| CVE-2022-1268 | donate-extra (WordPress plugin) | The Donate Extra WordPress plugin through 2.02 does not sanitise and escape a parameter before outputting it back in the response, leading t | medium | 6.1 | 1% |
| CVE-2022-1436 | track-\&-trace (WordPress plugin) | The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting | medium | 6.1 | 1% |
| CVE-2022-1455 | call-now-button (WordPress plugin) | The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, l | medium | 6.1 | 1% |
| CVE-2022-1528 | vik-booking (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScri | medium | 6.1 | 1% |
| CVE-2022-1547 | check-\&-log-email (WordPress plugin) | The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an | medium | 6.1 | 1% |
| CVE-2022-1582 | external-links-in-new-window-\/-new-tab (WordPress plugin) | The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handl | medium | 6.1 | 1% |
| CVE-2022-1673 | woocommerce-green-wallet-gateway (WordPress plugin) | The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it t | medium | 6.1 | 1% |
| CVE-2024-11360 | page-parts (WordPress plugin) | The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate e | medium | 6.1 | 1% |
| CVE-2018-5284 | imageinject (WordPress plugin) | The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php. | medium | 4.8 | 1% |
| CVE-2021-36901 | age-gate (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress. | medium | 6.1 | 1% |
| CVE-2025-24438 | magento/community-edition, magento/project-community-edition | Magento stored Cross-Site Scripting (XSS) vulnerability | high | 8.7 | 1% |
| CVE-2019-25146 | delucks-seo (WordPress plugin) | The DELUCKS SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saveSettings() function that had no capability che | high | 7.2 | 1% |
| CVE-2019-14785 | cp-contact-form-with-paypal (WordPress plugin) | The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_con | medium | 5.4 | 1% |
| CVE-2021-21283 | flarum/sticky | XSS in Flarum Sticky extension | medium | 0.0 | 1% |
| CVE-2022-31109 | laminas/laminas-diactoros | Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack | medium | 6.1 | 1% |
| CVE-2018-11485 | woocommerce-quick-reports (WordPress plugin) | The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject | medium | 6.1 | 1% |
| CVE-2022-0321 | wp-voting-contest (WordPress plugin) | The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the respon | medium | 6.1 | 1% |
| CVE-2022-0327 | master-addons-for-elementor (WordPress plugin) | The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it | medium | 6.1 | 1% |
| CVE-2015-8756 | typo3/cms | TYPO3 CMS indexed search Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2018-18373 | support-board---chat-and-help-desk (WordPress plugin) | In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file uplo | medium | 5.4 | 1% |
| CVE-2020-27851 | wp-premium/gravityforms | Gravity Forms stored HTML injection vulnerability | medium | 5.4 | 1% |
| CVE-2020-27852 | wp-premium/gravityforms | Gravity Forms stored Cross-Site Scripting (XSS) vulnerability in the survey feature | medium | 5.4 | 1% |
| CVE-2026-55579 | pheditor/pheditor | Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise | critical | 9.8 | 1% |
| CVE-2019-18210 | moodle/moodle | Moodle Persistent Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2021-24338 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2022-0472 | jsdecena/laracom | Unrestricted Upload of File with Dangerous Type in jsdecena/laracom | medium | 5.4 | 1% |
| CVE-2022-24873 | shopware/shopware | Reflected Cross-site Scripting in Shopware storefront | medium | 5.4 | 1% |
| CVE-2022-35589 | forkcms/forkcms | ForkCMS XSS via `publish_on_time` parameter | medium | 4.8 | 1% |
| CVE-2021-4108 | snipe/snipe-it | snipe-it is vulnerable to Cross-site Scripting | medium | 6.4 | 1% |
| CVE-2021-4121 | yetiforce/yetiforce-crm | yetiforcecrm is vulnerable to Cross-site Scripting | medium | 6.4 | 1% |
| CVE-2021-3983 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 6.3 | 1% |
| CVE-2018-11486 | advance-search-for-woocommerce (WordPress plugin) | An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to | medium | 6.1 | 1% |
| CVE-2021-3863 | snipe/snipe-it | Cross-site Scripting in snipe-it | medium | 5.5 | 1% |
| CVE-2023-1912 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, a | high | 7.2 | 1% |
| CVE-2019-16687 | dolibarr/dolibarr | Dolibarr Cross-site Scripting in a User Profile in a Signature section | medium | 5.4 | 1% |
| CVE-2024-10788 | aryo-activity-log (WordPress plugin) | The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters | high | 7.2 | 1% |
| CVE-2018-16347 | gleez/cms | Gleez CMS Vulnerable to Cross-site Scripting in media/imagecache/resize | medium | 6.1 | 1% |
| CVE-2022-0626 | advanced-admin-search (WordPress plugin) | The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin | medium | 6.1 | 1% |
| CVE-2022-1220 | foxyshop (WordPress plugin) | The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a | medium | 6.1 | 1% |
| CVE-2022-1470 | ultimate-woocommerce-csv-importer (WordPress plugin) | The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back | medium | 6.1 | 1% |
| CVE-2022-1546 | woocommerce---product-importer (WordPress plugin) | The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back i | medium | 6.1 | 1% |
| CVE-2022-1593 | site-offline-or-coming-soon (WordPress plugin) | The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lac | medium | 6.1 | 1% |
| CVE-2022-1773 | wp-athletics (WordPress plugin) | The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to | medium | 6.1 | 1% |
| CVE-2022-2090 | discount-rules-for-woocommerce (WordPress plugin) | The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of th | medium | 6.1 | 1% |
| CVE-2022-2173 | advanced-database-cleaner (WordPress plugin) | The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attr | medium | 6.1 | 1% |
| CVE-2022-4032 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and in | high | 7.2 | 1% |
| CVE-2020-13668 | drupal/core, drupal/drupal | Cross-site Scripting in Drupal Core | medium | 6.1 | 1% |
| CVE-2019-15837 | webp-express (WordPress plugin) | The webp-express plugin before 0.14.8 for WordPress has stored XSS. | medium | 5.4 | 1% |
| CVE-2024-11921 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 4.8 | 1% |