Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-8799 | wti-like-post (WordPress plugin) | A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the admin | medium | 4.8 | 1% |
| CVE-2022-0969 | image-optimization-\&-lazy-load-by-optimole (WordPress plugin) | The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images fo | medium | 4.8 | 1% |
| CVE-2021-35210 | contao/contao, contao/core-bundle | Cross site scripting in the system log | medium | 6.1 | 1% |
| CVE-2022-45150 | moodle/moodle | Moodle reflected cross-site scripting vulnerability in policy tool | medium | 6.1 | 1% |
| CVE-2020-20626 | lara\'s-google-analytics (WordPress plugin) | lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS. | medium | 5.4 | 1% |
| CVE-2022-3245 | microweber/microweber | Microweber vulnerable to HTML Injection in create tag functionality | medium | 6.1 | 1% |
| CVE-2022-2775 | fastflow (WordPress plugin) | The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege user | medium | 5.5 | 1% |
| CVE-2023-3083 | nilsteampassnet/teampass | TeamPass vulnerable to stored Cross-site Scripting | high | 8.7 | 1% |
| CVE-2022-4697 | wp-user-avatar (WordPress plugin) | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in ve | medium | 5.5 | 1% |
| CVE-2022-2190 | envira-gallery (WordPress plugin) | The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an | medium | 6.1 | 1% |
| CVE-2021-37710 | shopware/core, shopware/platform | Cross-Site Scripting via SVG media files | high | 8.0 | 1% |
| CVE-2019-15869 | jobcareer (WordPress theme) | The JobCareer theme before 2.5.1 for WordPress has stored XSS. | medium | 5.4 | 1% |
| CVE-2019-15870 | carspot (WordPress theme) | The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field. | medium | 5.4 | 1% |
| CVE-2022-0956 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2021-32713 | shopware/shopware | Cross-site scripting | medium | 4.8 | 1% |
| CVE-2024-24570 | statamic/cms | Statmic CMS vulnerable to account takeover via XSS and password reset link | high | 8.2 | 1% |
| CVE-2017-1000467 | lavalite/cms | Stored XSS in LavaLite 5.2.4 | medium | 5.4 | 1% |
| CVE-2021-32470 | craftcms/cms | Craft CMS Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2018-14835 | intelliants/subrion | Subrion CMS XSS | medium | 5.4 | 1% |
| CVE-2019-20789 | croogo/croogo | Croos-site scripting in Croogo | medium | 4.8 | 1% |
| CVE-2023-44769 | tribalsystems/zenario | Zenario CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-2565 | simple-payment-donations-\&-subscriptions (WordPress plugin) | The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which | high | 7.2 | 1% |
| CVE-2021-20681 | baserproject/basercms | Cross-site Scripting (XSS) in baserCMS | medium | 5.4 | 1% |
| CVE-2021-20683 | baserproject/basercms | Cross-site Scripting (XSS) in baserCMS | medium | 5.4 | 1% |
| CVE-2021-44565 | francoisjacquet/rosariosis | Cross site scripting in francoisjacquet/rosariosis | medium | 5.4 | 1% |
| CVE-2018-18943 | baserproject/basercms | XSS in baserCMS before 4.1.4 | medium | 4.8 | 1% |
| CVE-2020-11512 | idx-broker-platinum (WordPress plugin) | Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permis | medium | 5.4 | 1% |
| CVE-2022-1938 | awin-data-feed (WordPress plugin) | The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, all | medium | 5.4 | 1% |
| CVE-2025-47110 | magento/community-edition | Magneto contains stored XSS vulnerability | critical | 9.1 | 1% |
| CVE-2017-15812 | easy-appointments (WordPress plugin) | The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel. | medium | 6.1 | 1% |
| CVE-2020-36722 | visual-composer-website-builder (WordPress plugin) | The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient in | medium | 5.5 | 1% |
| CVE-2022-0278 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2021-24794 | connections-business-directory (WordPress plugin) | The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could a | medium | 4.8 | 1% |
| CVE-2021-32768 | typo3/cms, typo3/cms-core | Cross-Site Scripting via Rich-Text Content | medium | 6.1 | 1% |
| CVE-2022-29711 | librenms/librenms | Cross site scripting in librenms | medium | 6.1 | 1% |
| CVE-2024-7982 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event | critical | 9.6 | 1% |
| CVE-2021-24474 | awesome-weather-widget (WordPress plugin) | The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refresh AJAX action, lea | medium | 6.1 | 1% |
| CVE-2021-24560 | software-license-manager (WordPress plugin) | The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back i | medium | 6.1 | 1% |
| CVE-2019-14272 | silverstripe/framework | SilverStripe asset-admin Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2020-26227 | typo3/cms, typo3/cms-core | Cross-Site Scripting in Fluid view helpers | medium | 6.1 | 1% |
| CVE-2018-0578 | pixelyoursite (WordPress plugin) | Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary | medium | 5.4 | 1% |
| CVE-2018-21014 | buddymoss-media (WordPress plugin) | The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS. | medium | 5.4 | 1% |
| CVE-2020-25380 | recall-products (WordPress plugin) | Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in | medium | 5.4 | 1% |
| CVE-2023-2835 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and | medium | 6.1 | 1% |
| CVE-2017-14239 | dolibarr/dolibarr | Dolibarr cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2017-14241 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2021-3785 | yourls/yourls | Cross-site Scripting in yourls | medium | 5.4 | 1% |
| CVE-2021-4072 | elgg/elgg | elgg is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2018-11352 | wallabag/wallabag | Wallabag cross-site scripting (XSS) vulnerability | medium | 4.0 | 1% |
| CVE-2021-24565 | contact-form-7-captcha (WordPress plugin) | The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker t | high | 8.8 | 1% |