Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-16688 | dolibarr/dolibarr | Dolibarr stored Cross-site Scripting in an Email Template section | medium | 5.4 | 1% |
| CVE-2021-34650 | smart-id (WordPress plugin) | The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which al | medium | 5.4 | 1% |
| CVE-2024-6536 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privileg | medium | 5.4 | 1% |
| CVE-2022-31048 | typo3/cms, typo3/cms-core | Cross-Site Scripting in TYPO3's Form Framework | medium | 5.4 | 1% |
| CVE-2022-31049 | typo3/cms, typo3/cms-core | Cross-Site Scripting in TYPO3's Frontend Login Mailer | medium | 5.4 | 1% |
| CVE-2017-1000507 | austintoddj/canvas | Canvs Canvas XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2023-0038 | survey-maker (WordPress plugin) | The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in ve | high | 7.2 | 1% |
| CVE-2021-24617 | gamepress (WordPress plugin) | The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pa | medium | 6.1 | 1% |
| CVE-2021-44116 | anchorcms/anchor-cms | Cross-site Scripting in Anchor CMS | medium | 6.1 | 1% |
| CVE-2021-36875 | ulisting (WordPress plugin) | Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects | medium | 5.9 | 1% |
| CVE-2022-40044 | centreon/centreon | Centreon contains cross-site scripting vulnerability via esc_name parameter | medium | 5.4 | 1% |
| CVE-2022-2340 | w-dalil (WordPress plugin) | The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2022-2341 | simple-page-transition (WordPress plugin) | The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 1% |
| CVE-2022-3132 | goolytics (WordPress plugin) | The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to per | medium | 4.8 | 1% |
| CVE-2022-22293 | dolibarr/dolibarr | Cross site scripting in dolibarr | medium | 5.4 | 1% |
| CVE-2022-1514 | facturascripts/facturascripts | Cross site scripting in FacturaScripts | critical | 9.0 | 1% |
| CVE-2019-25140 | responsive-coming-soon (WordPress plugin) | The WordPress Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logo_width, logo | high | 7.2 | 1% |
| CVE-2020-21146 | feehi/cms | Feehi CMS vulnerable to Cross-site Scripting in Username Field | medium | 6.1 | 1% |
| CVE-2020-13644 | accordions (WordPress plugin) | An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action | medium | 5.4 | 1% |
| CVE-2022-0370 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 5.4 | 1% |
| CVE-2022-0957 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-3391 | retain-live-chat (WordPress plugin) | The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2019-12950 | nilsteampassnet/teampass | TeamPass Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2017-20058 | elefant/cms | Cross site scripting in Elefant CMS | medium | 6.1 | 1% |
| CVE-2021-20186 | moodle/moodle | Moodle Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-24504 | wp-learn-manager (WordPress plugin) | The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing | medium | 6.1 | 1% |
| CVE-2019-13644 | grumpydictator/firefly-iii | Firefly III vulnerable to stored XSS | medium | 5.4 | 1% |
| CVE-2019-13645 | grumpydictator/firefly-iii | Firefly III vulnerable to stored XSS | medium | 5.4 | 1% |
| CVE-2019-13646 | grumpydictator/firefly-iii | Firefly III vulnerable to reflected cross-site scripting | medium | 5.4 | 1% |
| CVE-2019-13647 | grumpydictator/firefly-iii | Firefly III vulnerable to image-based stored XSS | medium | 5.4 | 1% |
| CVE-2024-56527 | tecnickcom/tcpdf | TCPDF missing character escape on error messages | medium | 0.0 | 1% |
| CVE-2017-5197 | silverstripe/cms | Silverstripe CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2021-41188 | shopware/shopware | Authenticated Stored XSS in shopware/shopware | medium | 5.7 | 1% |
| CVE-2020-13864 | elementor-page-builder (WordPress plugin) | The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that r | medium | 5.4 | 1% |
| CVE-2020-13865 | elementor-page-builder (WordPress plugin) | The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create pos | medium | 5.4 | 1% |
| CVE-2017-10991 | wp-statistics (WordPress plugin) | The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page. | medium | 6.1 | 1% |
| CVE-2018-7280 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.2.14 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2021-24339 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2023-45818 | tinymce/tinymce | TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin | medium | 6.1 | 1% |
| CVE-2021-4365 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including | high | 7.2 | 1% |
| CVE-2022-1682 | facturascripts/facturascripts | Cross-site Scripting in facturascripts | medium | 6.1 | 1% |
| CVE-2022-30536 | wp-maintenance (WordPress plugin) | Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress. | low | 3.4 | 1% |
| CVE-2017-12948 | pressforward (WordPress plugin) | Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, relate | medium | 6.1 | 1% |
| CVE-2017-9337 | markdown-on-save-improved (WordPress plugin) | The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post. | medium | 6.1 | 1% |
| CVE-2022-29415 | ravpage (WordPress plugin) | Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress. | medium | 6.1 | 1% |
| CVE-2021-24841 | helpful (WordPress plugin) | The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perf | medium | 4.8 | 1% |
| CVE-2021-36895 | tripetto (WordPress plugin) | Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload. | medium | 4.7 | 1% |
| CVE-2022-29421 | countdown-builder (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycd_type vulnerable parameter. | medium | 4.7 | 1% |
| CVE-2016-10953 | headway (WordPress theme) | The Headway theme before 3.8.9 for WordPress has XSS via the license key field. | medium | 5.4 | 1% |
| CVE-2021-3961 | snipe/snipe-it | Cross-site Scripting in snipe/snipe-it | high | 8.0 | 1% |