Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-21418 | prestashop/ps_emailsubscription | Potential XSS injection in the newsletter conditions field | medium | 4.6 | 1% |
| CVE-2022-0926 | microweber/microweber | Cross-site Scripting in microweber | medium | 4.8 | 1% |
| CVE-2022-2532 | feed-them-social (WordPress plugin) | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 1% |
| CVE-2010-3660 | typo3/cms-backend | TYPO3 is vulnerable to Cross-Site Scripting (XSS) on the backend | medium | 5.4 | 1% |
| CVE-2020-11508 | wp-lead-plus-x (WordPress plugin) | An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or re | medium | 5.4 | 1% |
| CVE-2020-35944 | pagelayer (WordPress plugin) | An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, whic | high | 8.8 | 1% |
| CVE-2022-1951 | core-plugin-for-kitestudio-themes (WordPress plugin) | The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a r | medium | 6.1 | 1% |
| CVE-2015-9389 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name. | medium | 5.4 | 1% |
| CVE-2016-11012 | sola-support-tickets (WordPress plugin) | The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS. | medium | 5.4 | 1% |
| CVE-2022-1988 | facturascripts/facturascripts | Cross-site Scripting in FacturaScripts | medium | 6.5 | 1% |
| CVE-2020-11055 | ssddanbrown/bookstack | Cross-Site Scripting in BookStack | medium | 6.3 | 1% |
| CVE-2018-20101 | import-users-from-csv-with-meta (WordPress plugin) | The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell. | medium | 6.1 | 1% |
| CVE-2021-24873 | tutor (WordPress plugin) | The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Reg | medium | 6.1 | 1% |
| CVE-2021-24908 | check-\&-log-email (WordPress plugin) | The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a | medium | 6.1 | 1% |
| CVE-2021-24999 | booster-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in | medium | 6.1 | 1% |
| CVE-2021-25000 | booster-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back | medium | 6.1 | 1% |
| CVE-2021-25001 | booster-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before o | medium | 6.1 | 1% |
| CVE-2021-36885 | contact-form-cfdb7 (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versio | medium | 6.1 | 1% |
| CVE-2021-38357 | sms-ovh (WordPress plugin) | The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file | medium | 6.1 | 1% |
| CVE-2021-38358 | moolamojo (WordPress plugin) | The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generat | medium | 6.1 | 1% |
| CVE-2021-38361 | htaccess-redirect (WordPress plugin) | The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redir | medium | 6.1 | 1% |
| CVE-2021-39309 | parsian-bank-gateway-for-woocommerce (WordPress plugin) | The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parameter due to a var_dum | medium | 6.1 | 1% |
| CVE-2021-39310 | real-wysiwyg (WordPress plugin) | The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file | medium | 6.1 | 1% |
| CVE-2021-39311 | link-list-manager (WordPress plugin) | The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php fil | medium | 6.1 | 1% |
| CVE-2021-39313 | simple-responsive-image-gallery (WordPress plugin) | The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image- | medium | 6.1 | 1% |
| CVE-2021-39314 | woo-enviopack (WordPress plugin) | The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/ | medium | 6.1 | 1% |
| CVE-2021-39315 | magic-post-voice (WordPress plugin) | The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.ph | medium | 6.1 | 1% |
| CVE-2021-39318 | h5p-css-editor (WordPress plugin) | The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-ed | medium | 6.1 | 1% |
| CVE-2019-16685 | dolibarr/dolibarr | Dolibarr stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-0877 | ssddanbrown/bookstack | Cross-site Scripting in BookStack | medium | 5.4 | 1% |
| CVE-2022-35590 | forkcms/forkcms | ForkCMS XSS via `end_date` parameter | medium | 4.8 | 1% |
| CVE-2021-39166 | pimcore/pimcore | Improper Neutralization of Text-Values in Object Version Preview | high | 8.0 | 1% |
| CVE-2017-12068 | event-list (WordPress plugin) | The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk ac | medium | 6.1 | 1% |
| CVE-2017-12131 | easy-testimonials (WordPress plugin) | The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonial | medium | 6.1 | 1% |
| CVE-2017-17869 | mgl-instagram-gallery (WordPress plugin) | The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter. | medium | 6.1 | 1% |
| CVE-2018-5655 | pinterest-feeds (WordPress plugin) | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security para | medium | 6.1 | 1% |
| CVE-2018-6001 | soundy-audio-playlist (WordPress plugin) | The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war | medium | 6.1 | 1% |
| CVE-2018-6002 | soundy-background-music (WordPress plugin) | The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php | medium | 6.1 | 1% |
| CVE-2021-4081 | pimcore/pimcore | pimcore is vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2021-4358 | wp-dsgvo-tools (WordPress plugin) | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and | high | 7.2 | 1% |
| CVE-2019-14946 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. | medium | 5.4 | 1% |
| CVE-2020-9334 | envira-gallery-lite (WordPress plugin) | A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerabil | medium | 5.4 | 1% |
| CVE-2021-31274 | librenms/librenms | Cross-site Scripting in LibreNMS | medium | 5.4 | 1% |
| CVE-2022-1445 | snipe/snipe-it | Stored cross-site scripting in Snipe-IT | medium | 5.4 | 1% |
| CVE-2022-0889 | ninja-forms-file-uploads (WordPress plugin) | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the | high | 7.2 | 1% |
| CVE-2020-35589 | limit-login-attempts-reloaded (WordPress plugin) | The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. | medium | 5.4 | 1% |
| CVE-2022-2924 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module | medium | 5.4 | 1% |
| CVE-2023-0585 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and inc | medium | 4.4 | 1% |
| CVE-2017-7723 | easy-wp-smtp (WordPress plugin) | XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body. | medium | 6.1 | 1% |
| CVE-2019-16686 | dolibarr/dolibarr | Dolibarr Cross-site Scripting in a User Note section | medium | 5.4 | 1% |