Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2406 | event-registration-calendar-by-vcita (WordPress plugin), online-payments---get-paid-with-paypal\,-square-\&-stripe (WordPress plugin) | The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & St | medium | 6.4 | 1% |
| CVE-2017-1000510 | croogo/croogo | Cross site scripting in Croogo | medium | 5.4 | 1% |
| CVE-2021-36869 | add-search-to-menu (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post. | medium | 4.8 | 1% |
| CVE-2022-37721 | pyrocms/pyrocms | PyroCMS vulnerable to stored Cross Site Scripting | critical | 9.0 | 1% |
| CVE-2023-38219 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Scripting (XSS) | high | 8.7 | 1% |
| CVE-2022-41938 | flarum/core | Cross site scripting vulnerability with discussion titles | critical | 9.0 | 1% |
| CVE-2022-1772 | google-places-reviews (WordPress plugin) | The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site' | medium | 4.8 | 1% |
| CVE-2021-42546 | use-your-drive (WordPress plugin) | Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to | medium | 4.7 | 1% |
| CVE-2021-42547 | out-of-the-box (WordPress plugin) | Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to | medium | 4.7 | 1% |
| CVE-2021-42548 | share-one-drive (WordPress plugin) | Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to | medium | 4.7 | 1% |
| CVE-2021-42549 | lets-box (WordPress plugin) | Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft | medium | 4.7 | 1% |
| CVE-2022-1457 | neorazorx/facturascripts | Cross site scripting in facturascripts | critical | 9.0 | 1% |
| CVE-2019-15836 | wp-ultimate-recipe (WordPress plugin) | The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS. | medium | 5.4 | 1% |
| CVE-2022-0942 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2021-25102 | all-in-one-wp-security-\&-firewall (WordPress plugin) | The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before | medium | 4.7 | 1% |
| CVE-2021-25103 | translate-wordpress-with-gtranslate (WordPress plugin) | The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtran | medium | 4.7 | 1% |
| CVE-2022-2763 | wp-socializer (WordPress plugin) | The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2021-27938 | symbiote/silverstripe-queuedjobs | XSS in CreateQueuedJobTask | medium | 0.0 | 1% |
| CVE-2021-24205 | website-builder (WordPress plugin) | In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ p | medium | 5.4 | 1% |
| CVE-2019-25147 | pretty-link (WordPress plugin) | The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in v | high | 7.2 | 1% |
| CVE-2020-15263 | orchid/platform | Inline attribute values were not processed. | high | 8.0 | 1% |
| CVE-2021-24147 | modern-events-calendar-lite (WordPress plugin) | Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise | medium | 5.4 | 1% |
| CVE-2018-5363 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or | medium | 4.8 | 1% |
| CVE-2018-5365 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options | medium | 4.8 | 1% |
| CVE-2018-5366 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php. | medium | 4.8 | 1% |
| CVE-2022-4035 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions | high | 7.2 | 1% |
| CVE-2021-24455 | tutor-lms (WordPress plugin) | The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when o | medium | 5.4 | 1% |
| CVE-2024-3822 | base64-encoder\/decoder (WordPress plugin) | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, le | medium | 4.8 | 1% |
| CVE-2024-0376 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Wrapper Link Widget in a | medium | 6.4 | 1% |
| CVE-2021-24201 | website-builder (WordPress plugin) | In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ para | medium | 5.4 | 1% |
| CVE-2021-24202 | website-builder (WordPress plugin) | In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ pa | medium | 5.4 | 1% |
| CVE-2021-24203 | website-builder (WordPress plugin) | In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ para | medium | 5.4 | 1% |
| CVE-2021-24204 | website-builder (WordPress plugin) | In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_ | medium | 5.4 | 1% |
| CVE-2021-24206 | website-builder (WordPress plugin) | In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ | medium | 5.4 | 1% |
| CVE-2019-8233 | magento/community-edition | Composer JavaScript injection possible via html comments | medium | 6.1 | 1% |
| CVE-2023-0376 | qubely (WordPress plugin) | The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post w | medium | 5.4 | 1% |
| CVE-2023-5135 | simple-cloudflare-turnstile (WordPress plugin) | The Simple Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gravity-simple-turnstile' shortcode i | medium | 6.4 | 1% |
| CVE-2019-25148 | wp-html-mail (WordPress plugin) | The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.9.0.3 due to insufficient input sa | medium | 6.1 | 1% |
| CVE-2021-4363 | wp-quick-front-end-editor (WordPress plugin) | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5 due | medium | 6.1 | 1% |
| CVE-2023-1269 | alextselegidis/easyappointments | Easy!Appointments uses hard-coded credentials | critical | 9.8 | 1% |
| CVE-2023-1372 | wh-testimonials (WordPress plugin) | The WH Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as wh_homepage, wh_text_s | high | 7.2 | 1% |
| CVE-2020-13669 | drupal/core, drupal/drupal | Drupal core's built-in CKEditor image caption functionality is vulnerable to XSS. | medium | 6.1 | 1% |
| CVE-2022-0880 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-3765 | thorsten/phpmyfaq | phpMyFAQ vulnerable to stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-24323 | woocommerce/woocommerce | Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled | medium | 4.8 | 1% |
| CVE-2022-3035 | snipe/snipe-it | snipe-it vulnerable to cross-site scripting (XSS) | medium | 4.8 | 1% |
| CVE-2022-2189 | wp-video-lightbox (WordPress plugin) | The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an at | medium | 6.1 | 1% |
| CVE-2022-4710 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, du | medium | 6.1 | 1% |
| CVE-2019-10772 | enshrined/svg-sanitize | Sanitizer bypass in svg-sanitizer | medium | 6.1 | 1% |
| CVE-2023-4635 | eventon-lite (WordPress plugin) | The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2 | medium | 6.1 | 1% |