Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-10735 | twbs/bootstrap | Bootstrap Cross-site Scripting vulnerability | medium | 6.1 | 4% |
| CVE-2014-4592 | wp-planet (WordPress plugin) | Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows | medium | 6.1 | 4% |
| CVE-2017-15284 | october/rain | OctoberCMS Cross-Site Scripting | medium | 5.4 | 4% |
| CVE-2017-9288 | raygun4wp (WordPress plugin) | The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter). | medium | 6.1 | 4% |
| CVE-2018-14042 | twbs/bootstrap | Bootstrap Cross-site Scripting vulnerability | medium | 6.1 | 4% |
| CVE-2018-20677 | twbs/bootstrap | bootstrap Cross-site Scripting vulnerability | medium | 6.1 | 4% |
| CVE-2014-4535 | import-legacy-media (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject a | medium | 6.1 | 4% |
| CVE-2014-4539 | movies (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web | medium | 6.1 | 4% |
| CVE-2016-1000149 | simpel-reserveren (WordPress plugin) | Reflected XSS in wordpress plugin simpel-reserveren v3.5.2 | medium | 6.1 | 4% |
| CVE-2018-20462 | jsmol2wp (WordPress plugin) | An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inj | medium | 6.1 | 4% |
| CVE-2008-0193 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remot | medium | 4.3 | 4% |
| CVE-2008-3233 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 2.6, SVN development versions only, allows remote attackers to inject arbitrary | medium | 4.3 | 4% |
| CVE-2014-4550 | ninja (WordPress plugin) | Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allow | medium | 6.1 | 4% |
| CVE-2013-1765 | smart-flv (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject a | medium | 4.3 | 4% |
| CVE-2015-4065 | landing-pages (WordPress plugin) | Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress | low | 3.5 | 4% |
| CVE-2017-12062 | mantisbt/mantisbt | MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php | medium | 6.1 | 4% |
| CVE-2014-4536 | infusionsoft (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms | medium | 6.1 | 4% |
| CVE-2019-19212 | dolibarr/dolibarr | Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php | critical | 9.8 | 4% |
| CVE-2021-24335 | car-repair-services-\&-auto-mechanic (WordPress plugin) | The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before | medium | 6.1 | 4% |
| CVE-2025-68614 | librenms/librenms | LibreNMS Alert Rule API Cross-Site Scripting Vulnerability | medium | 4.3 | 4% |
| CVE-2022-0378 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 4% |
| CVE-2022-0381 | embed-swagger (WordPress plugin) | The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation | medium | 6.1 | 4% |
| CVE-2014-9311 | shareaholic (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated use | low | 3.5 | 4% |
| CVE-2015-6920 | sourceafrica (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject a | medium | 4.3 | 4% |
| CVE-2018-20676 | twbs/bootstrap | XSS vulnerability that affects bootstrap | medium | 6.1 | 4% |
| CVE-2022-0765 | loco-translate (WordPress plugin) | The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings befo | medium | 5.4 | 4% |
| CVE-2014-4561 | ultimate-weather (WordPress plugin) | The ultimate-weather plugin 1.0 for WordPress has XSS | medium | 6.1 | 4% |
| CVE-2014-4544 | podcast-channels (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arb | medium | 6.1 | 4% |
| CVE-2020-15038 | coming-soon (WordPress plugin) | The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS. | medium | 5.4 | 4% |
| CVE-2021-24389 | foodbakery (WordPress plugin) | The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_ra | medium | 6.1 | 4% |
| CVE-2012-6624 | soundcloud-is-gold (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web | medium | 4.3 | 4% |
| CVE-2014-8800 | nextend-facebook-connect (WordPress plugin) | Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress | medium | 4.3 | 4% |
| CVE-2018-10310 | uk-cookie-consent (WordPress plugin) | A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3 | medium | 5.4 | 4% |
| CVE-2012-2579 | wp-simplemail (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP SimpleMail plugin 1.0.6 for WordPress allow remote attackers to inject arbitra | medium | 4.3 | 4% |
| CVE-2012-2580 | postie (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Postie plugin 1.4.3, and possibly before 1.5.15, for WordPress allows remote attackers to in | medium | 4.3 | 4% |
| CVE-2012-2583 | mini-mail-dashboard-widget (WordPress plugin) | Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary | medium | 4.3 | 4% |
| CVE-2020-15364 | nexos (WordPress theme) | The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS. | medium | 6.1 | 4% |
| CVE-2020-25627 | moodle/moodle | Moodle stored Cross-site Scripting (XSS) | medium | 6.1 | 4% |
| CVE-2016-1000126 | admin-font-editor (WordPress plugin) | Reflected XSS in wordpress plugin admin-font-editor v1.8 | medium | 6.1 | 4% |
| CVE-2016-1000127 | ajax-random-post (WordPress plugin) | Reflected XSS in wordpress plugin ajax-random-post v2.00 | medium | 6.1 | 4% |
| CVE-2018-20418 | craftcms/cms | Craft CMS Cross-site Scripting (XSS) Vulnerability | medium | 4.8 | 4% |
| CVE-2018-5316 | sagepay-server-gateway-for-woocommerce (WordPress plugin) | The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter. | medium | 6.1 | 4% |
| CVE-2021-24387 | real-estate-7 (WordPress plugin) | The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before | medium | 6.1 | 4% |
| CVE-2019-16173 | limesurvey/limesurvey | Cross-site Scripting in LimeSurvey | medium | 5.4 | 4% |
| CVE-2018-14840 | intelliants/subrion | Subrion CMS Cross-site Scripting | medium | 6.1 | 4% |
| CVE-2013-4241 | hms-testimonials (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inj | medium | 6.1 | 4% |
| CVE-2018-5233 | getgrav/grav | Grav CMS Cross-site scripting (XSS) vulnerability | medium | 6.1 | 4% |
| CVE-2018-9844 | wp-file-upload (WordPress plugin) | The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. | medium | 6.1 | 4% |
| CVE-2011-4280 | moodle/moodle | Moodle vulnerable to XSS via bundled spikephpcoverage library | medium | 0.0 | 4% |
| CVE-2020-12054 | catch-breadcrumb (WordPress plugin) | The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 theme | medium | 6.1 | 4% |