Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0602 | tastyigniter/tastyigniter | Cross-site Scripting in TastyIgniter | high | 7.4 | 1% |
| CVE-2022-30875 | dolibarr/dolibarr | Cross-site Scripting in Dolibarr | medium | 6.1 | 1% |
| CVE-2023-1893 | login-configurator (WordPress plugin) | The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a | medium | 6.1 | 1% |
| CVE-2024-55228 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2017-7204 | imdbphp/imdbphp | imdbphp Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2019-19541 | listingpro (WordPress theme) | The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page. | medium | 5.4 | 1% |
| CVE-2019-19542 | listingpro (WordPress theme) | The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page. | medium | 5.4 | 1% |
| CVE-2020-25375 | wp-smart-crm-\&-invoices (WordPress plugin) | Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code fiel | medium | 5.4 | 1% |
| CVE-2020-26672 | testimonial-rotator (WordPress plugin) | Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request a | medium | 5.4 | 1% |
| CVE-2019-20181 | awesome-support (WordPress plugin) | The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter. | medium | 4.8 | 1% |
| CVE-2019-20182 | foogallery (WordPress plugin) | The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. | medium | 4.8 | 1% |
| CVE-2022-40313 | moodle/moodle | Moodle Stored Cross-site Scripting and page denial of service | high | 7.1 | 1% |
| CVE-2018-18872 | calendar (WordPress plugin) | The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=cale | medium | 5.4 | 1% |
| CVE-2022-0698 | microweber/microweber | Microweber vulnerable to cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2023-48219 | tinymce/tinymce | TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes | medium | 6.1 | 1% |
| CVE-2020-27388 | yourls/yourls | YOURLS Stored Cross Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2018-14520 | getkirby/cms | Kirby CMS 2.5.12 Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-44763 | concrete5/concrete5 | ConcreteCMS vulnerable to Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-1255 | import-and-export-users-and-customers (WordPress plugin) | The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allo | medium | 4.8 | 1% |
| CVE-2017-18286 | nzedb/nzedb | nZEDb Cross-site Scripting (XSS) in the 404 error page | medium | 5.4 | 1% |
| CVE-2024-29203 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes | medium | 4.3 | 1% |
| CVE-2024-29881 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements | medium | 4.3 | 1% |
| CVE-2020-11516 | contact-form-7-datepicker (WordPress plugin) | Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to sa | medium | 5.4 | 1% |
| CVE-2021-44566 | francoisjacquet/rosariosis | Cross site scripting in francoisjacquet/rosariosis | medium | 5.4 | 1% |
| CVE-2022-45151 | moodle/moodle | Moodle stored-XSS vulnerability in some "social" user profile fields | medium | 5.4 | 1% |
| CVE-2022-2563 | tutor-lms (WordPress plugin) | The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to | medium | 4.8 | 1% |
| CVE-2022-33994 | gutenberg (WordPress plugin) | The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" fea | low | 3.0 | 1% |
| CVE-2017-1002017 | gift-certificate-creator (WordPress plugin) | Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS | medium | 6.1 | 1% |
| CVE-2024-1588 | sendpress (WordPress plugin) | The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privi | medium | 6.8 | 1% |
| CVE-2022-29425 | checkout-files-upload-woocommerce (WordPress plugin) | Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress. | medium | 6.1 | 1% |
| CVE-2015-9393 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter. | medium | 5.4 | 1% |
| CVE-2022-38724 | silverstripe/assets, silverstripe/framework | Silverstripe XSS in shortcodes | medium | 5.4 | 1% |
| CVE-2019-19110 | wpforo (WordPress plugin) | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. | medium | 4.8 | 1% |
| CVE-2022-29408 | advanced-cf7-db (WordPress plugin) | Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress. | medium | 4.7 | 1% |
| CVE-2024-13098 | wordpress-email-newsletter (WordPress plugin) | The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, | medium | 5.4 | 1% |
| CVE-2024-4484 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 1% |
| CVE-2018-1000556 | wp-statistics (WordPress plugin) | WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can res | medium | 6.1 | 1% |
| CVE-2021-24871 | get-custom-field-values (WordPress plugin) | The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allo | medium | 5.4 | 1% |
| CVE-2022-25238 | silverstripe/framework | Stored XSS via HTML fields in SilverStripe Framework | medium | 5.4 | 1% |
| CVE-2024-0852 | coreactivity (WordPress plugin) | The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin | high | 8.8 | 1% |
| CVE-2023-30860 | wwbn/avideo | WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account | high | 8.0 | 1% |
| CVE-2024-24815 | ckeditor/ckeditor | CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection | medium | 6.1 | 1% |
| CVE-2023-37611 | neos/media-browser | Neos CMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2018-5657 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_ | medium | 4.8 | 1% |
| CVE-2018-5659 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_ti | medium | 4.8 | 1% |
| CVE-2018-5661 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width par | medium | 4.8 | 1% |
| CVE-2018-5664 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 | medium | 4.8 | 1% |
| CVE-2023-5744 | very-simple-google-maps (WordPress plugin) | The Very Simple Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vsgmap' shortcode in all ver | medium | 6.4 | 1% |
| CVE-2024-6517 | contact-form-7-math-captcha (WordPress plugin) | The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 1% |
| CVE-2018-20368 | master-slider (WordPress plugin) | The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings valu | medium | 5.4 | 1% |