Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-28106 | pimcore/pimcore | Cross-site Scripting (XSS) in UrlSlug Data type | medium | 4.8 | 1% |
| CVE-2022-4213 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page | medium | 6.1 | 1% |
| CVE-2022-26332 | andreapollastri/cipi | Cross-site Scripting in Cipi | medium | 5.4 | 1% |
| CVE-2022-31148 | shopware/shopware | Shopware vulnerable to persistent cross site scripting (XSS) in customer module | medium | 5.4 | 1% |
| CVE-2024-13097 | wp-finance (WordPress plugin) | The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 5.4 | 1% |
| CVE-2024-13099 | widget4call (WordPress plugin) | The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 5.4 | 1% |
| CVE-2024-10709 | yadisk-files (WordPress plugin) | The YaDisk Files WordPress plugin through 1.2.5 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 6.8 | 1% |
| CVE-2022-35174 | getkirby/starterkit | Cross site scripting in getkirby/starterkit | medium | 5.4 | 1% |
| CVE-2022-2374 | simply-schedule-appointments (WordPress plugin) | The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high p | medium | 4.8 | 1% |
| CVE-2024-27300 | phpmyfaq/phpmyfaq | phpMyFAQ stored Cross-site Scripting at user email | medium | 5.5 | 1% |
| CVE-2020-15020 | elementor (WordPress plugin) | An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name | medium | 5.4 | 1% |
| CVE-2021-24225 | advanced-booking-calendar (WordPress plugin) | The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page befor | medium | 5.4 | 1% |
| CVE-2022-2495 | microweber/microweber | Microweber Stored Cross-site Scripting before v1.2.20 | medium | 4.8 | 1% |
| CVE-2019-16904 | nilsteampassnet/teampass | TeamPass Cross-site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2023-4979 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-4980 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-37302 | wikibase/wikibase | MediaWiki Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-4698 | wp-user-avatar (WordPress plugin) | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, | medium | 5.5 | 1% |
| CVE-2021-24911 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJA | medium | 5.4 | 1% |
| CVE-2024-2311 | avada (WordPress plugin) | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, | medium | 6.4 | 1% |
| CVE-2023-46734 | symfony/symfony, symfony/twig-bridge | Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters | medium | 6.1 | 1% |
| CVE-2022-0374 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 6.5 | 1% |
| CVE-2023-2304 | favorites (WordPress plugin) | The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_favorites' shortcode in versions up to, and in | medium | 6.4 | 1% |
| CVE-2023-0325 | uvdesk/community-skeleton | Uvdesk vulnerable to stored cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-0894 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2022-1997 | francoisjacquet/rosariosis | Cross-site Scripting in RosarioSIS | medium | 5.4 | 1% |
| CVE-2022-2016 | facturascripts/facturascripts | Cross-site Scripting in FacturaScripts | medium | 5.4 | 1% |
| CVE-2021-24482 | related-posts (WordPress plugin) | The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (adm | medium | 4.8 | 1% |
| CVE-2017-9068 | modx/revolution | MODX Revolution Reflected XSS | medium | 6.1 | 1% |
| CVE-2018-15563 | intelliants/subrion | Subrion CMS Stored Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-4216 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and | medium | 5.5 | 1% |
| CVE-2022-4217 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and includ | medium | 5.5 | 1% |
| CVE-2018-17782 | mantisbt/mantisbt | MantisBT allows XSS via the Manage Filter page | medium | 5.4 | 1% |
| CVE-2018-17783 | mantisbt/mantisbt | MantisBT allows XSS via Edit Filter page | medium | 5.4 | 1% |
| CVE-2021-27131 | moodle/moodle | Moodle vulnerable to stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-24900 | ninja-tables (WordPress plugin) | The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-1512 | scrollrevealjs-effects (WordPress plugin) | The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users t | medium | 4.8 | 1% |
| CVE-2024-1935 | rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulner | high | 7.2 | 1% |
| CVE-2019-12748 | typo3/cms, typo3/cms-core | Typo3 Cross-Site Scripting in Link Handling | medium | 6.1 | 1% |
| CVE-2019-19325 | silverstripe/framework | Reflected XSS in SilverStripe | medium | 6.1 | 1% |
| CVE-2020-26523 | froala/wysiwyg-editor | Froala WYSIWYG Editor XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-2167 | newspaper (WordPress plugin) | The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, lea | medium | 6.1 | 1% |
| CVE-2022-3070 | generate-pdf-using-contact-form-7 (WordPress plugin) | The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perfo | medium | 4.8 | 1% |
| CVE-2021-25115 | wp-photo-album-plus (WordPress plugin) | The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled im | medium | 6.4 | 1% |
| CVE-2017-14761 | genix/cms | GeniXCMS Cross-site Scripting (XSS) vulnerability via id parameter | medium | 6.1 | 1% |
| CVE-2017-14762 | genix/cms | GeniXCMS Cross-site Scripting (XSS) via id parameter | medium | 6.1 | 1% |
| CVE-2017-14765 | genix/cms | GeniXCMS Cross-site Scripting (XSS) via the Menu ID field | medium | 6.1 | 1% |
| CVE-2017-17431 | genix/cms | GeniXCMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2023-3009 | nilsteampassnet/teampass | nilsteampassnet/teampass vulnerable to cross-site scripting | medium | 5.4 | 1% |
| CVE-2021-24702 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow | medium | 4.8 | 1% |