Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0251 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2022-0598 | login-with-phone-number (WordPress plugin) | The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2025-24410 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24412 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24413 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24414 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24415 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24416 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24417 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2021-24813 | events-made-easy (WordPress plugin) | The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perfor | medium | 4.8 | 1% |
| CVE-2022-3036 | gettext-override-translations (WordPress plugin) | The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | 1% |
| CVE-2021-24243 | wpbakery-page-builder-clipboard (WordPress plugin) | An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability che | medium | 5.4 | 1% |
| CVE-2021-24322 | database-backup (WordPress plugin) | The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attri | medium | 5.4 | 1% |
| CVE-2024-7354 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cro | medium | 6.1 | 1% |
| CVE-2017-6484 | inter-mediator/inter-mediator | INTER-Mediator Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-2655 | classified-listing (WordPress plugin) | The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an ad | medium | 6.1 | 1% |
| CVE-2020-13240 | dolibarr/dolibarr | Dolibarr Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-44760 | concrete5/concrete5 | Concrete CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-48701 | statamic/cms | Cross-site Scripting via uploaded assets | high | 7.5 | 1% |
| CVE-2022-0375 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 6.5 | 1% |
| CVE-2020-14320 | moodle/moodle | Moodle reflected XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2023-47380 | admidio/admidio | Cross-site Scripting in Admidio | medium | 6.1 | 1% |
| CVE-2022-3231 | librenms/librenms | LibreNMS stored Cross-site Scripting via Schedule Maintenance `Title` parameter | medium | 5.4 | 1% |
| CVE-2021-42365 | asgaros-forum (WordPress plugin) | The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found i | medium | 4.8 | 1% |
| CVE-2021-27910 | mautic/core | Stored XSS vulnerability on Bounce Management Callback | high | 8.2 | 1% |
| CVE-2024-39400 | magento/community-edition, magento/project-community-edition | Magento DOM-based Cross-Site Scripting (XSS) vulnerability | high | 8.1 | 1% |
| CVE-2020-28650 | page-builder (WordPress plugin) | The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protect | medium | 6.4 | 1% |
| CVE-2021-45895 | netgen/tagsbundle | Cross-site Scripting in Netgen Tags Bundle | medium | 6.1 | 1% |
| CVE-2021-25026 | patreon-wordpress (WordPress plugin) | The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privileg | medium | 5.5 | 1% |
| CVE-2015-20106 | clickbank-affiliate-ads (WordPress plugin) | The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site | medium | 4.8 | 1% |
| CVE-2021-24888 | imageboss (WordPress plugin) | The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to | medium | 4.8 | 1% |
| CVE-2023-4549 | dologin-security (WordPress plugin) | The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can b | medium | 6.1 | 1% |
| CVE-2020-11823 | dolibarr/dolibarr | Dolibarr stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2020-13239 | dolibarr/dolibarr | Dolibarr Stored Cross-site Scripting via file upload | medium | 5.4 | 1% |
| CVE-2021-24313 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress websi | medium | 5.4 | 1% |
| CVE-2022-3002 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-2628 | dsgvo-all-in-one-for-wp (WordPress plugin) | The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-3128 | donation-thermometer (WordPress plugin) | The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 1% |
| CVE-2020-19825 | kimai/kimai | Cross-site Scripting in kimai/kimai | critical | 9.6 | 1% |
| CVE-2022-31057 | shopware/shopware | Authenticated Stored Cross-site Scripting in Shopware | medium | 5.4 | 1% |
| CVE-2020-5273 | prestashop/ps_linklist | Stored XSS with custom URLs in PrestaShop module ps_linklist | medium | 4.1 | 1% |
| CVE-2021-3783 | yourls/yourls | Cross-site Scripting in yourls | medium | 6.6 | 1% |
| CVE-2018-12290 | ptheofan/yii2-statemachine | Yii2-StateMachine extension for Yii2 XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-18600 | formcraft (WordPress plugin) | The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field. | medium | 5.4 | 1% |
| CVE-2020-13892 | sportspress (WordPress plugin) | The SportsPress plugin before 2.7.2 for WordPress allows XSS. | medium | 5.4 | 1% |
| CVE-2021-41236 | oro/platform | XSS vulnerability on email template preview page | medium | 6.9 | 1% |
| CVE-2021-24518 | notification-bar (WordPress plugin) | The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege | medium | 4.8 | 1% |
| CVE-2022-2072 | name-directory (WordPress plugin) | The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 1% |
| CVE-2022-2181 | advanced-wordpress-reset (WordPress plugin) | The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes | medium | 6.1 | 1% |
| CVE-2015-9354 | gigpress (WordPress plugin) | The gigpress plugin before 2.3.11 for WordPress has XSS. | medium | 4.8 | 1% |