Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-32061 | snipe/snipe-it | Snipe-IT 6.0.2 vulnerable to Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2020-20523 | gilacms/gila | Gila CMS Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2026-81887 | livewire/livewire | Livewire DOM-based cross-site scripting during client-side state handling | medium | 0.0 | 1% |
| CVE-2024-13624 | wpmovielibrary (WordPress plugin) | The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 1% |
| CVE-2022-2537 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting th | medium | 6.1 | 1% |
| CVE-2022-2538 | wp-hide-\&-security-enhancer (WordPress plugin) | The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an attribute of a backe | medium | 6.1 | 1% |
| CVE-2023-33197 | craftcms/cms | Craft CMS stored XSS in indexedVolumes | medium | 5.5 | 1% |
| CVE-2021-24494 | wp-offload-ses-lite (WordPress plugin) | The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as | medium | 5.4 | 1% |
| CVE-2022-0145 | forkcms/forkcms | Cross-site Scripting in Fork CMS | medium | 5.4 | 1% |
| CVE-2023-38970 | uasoft-indonesia/badaso | Badaso vulnerable to cross-site scripting | medium | 5.4 | 1% |
| CVE-2022-0684 | wp-home-page-menu (WordPress plugin) | The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to | medium | 4.8 | 1% |
| CVE-2022-37342 | add-actions-and-filters (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress. | medium | 4.8 | 1% |
| CVE-2024-0598 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the con | medium | 4.4 | 1% |
| CVE-2023-4774 | wp-piwik (WordPress plugin) | The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versi | medium | 6.4 | 1% |
| CVE-2022-23638 | enshrined/svg-sanitize | Cross-site Scripting in enshrined/svg-sanitize | medium | 6.2 | 1% |
| CVE-2017-1000431 | ezsystems/ezpublish-legacy | eZ Publish Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2019-18656 | pimcore/pimcore | Pimcore XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2020-13633 | forkcms/forkcms | Fork CMS Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2021-24196 | social-slider-widget (WordPress plugin) | The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ | medium | 5.4 | 1% |
| CVE-2024-0614 | events-manager (WordPress plugin) | The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including | medium | 4.4 | 1% |
| CVE-2019-13376 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2024-3231 | popup4phone (WordPress plugin) | The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perf | medium | 6.1 | 1% |
| CVE-2011-4630 | typo3/cms | Typo3 XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2011-4632 | typo3/cms | Typo3 XSS Vulnerabilities | medium | 5.4 | 1% |
| CVE-2020-13672 | drupal/core, drupal/drupal | Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. Not all sites | medium | 6.1 | 1% |
| CVE-2023-35131 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2018-0570 | baserproject/basercms | XSS in baserCMS | medium | 5.4 | 1% |
| CVE-2022-2065 | facturascripts/facturascripts | Cross-site Scripting in FacturaScripts | medium | 5.4 | 1% |
| CVE-2022-3739 | wp-best-quiz (WordPress plugin) | The WP Best Quiz WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as Au | medium | 5.4 | 1% |
| CVE-2022-1334 | wp-youtube-live (WordPress plugin) | The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high pri | medium | 4.8 | 1% |
| CVE-2022-1566 | quotes-llama (WordPress plugin) | The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to | medium | 4.8 | 1% |
| CVE-2022-2351 | post-smtp (WordPress plugin) | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashb | medium | 4.8 | 1% |
| CVE-2022-2737 | wp-staging (WordPress plugin) | The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-2799 | affiliates-manager (WordPress plugin) | The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 1% |
| CVE-2022-2887 | wp-server-health-stats (WordPress plugin) | The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to per | medium | 4.8 | 1% |
| CVE-2022-3135 | seo-smart-links (WordPress plugin) | The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2021-24382 | smart-slider (WordPress plugin) | The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, le | medium | 5.4 | 1% |
| CVE-2021-24574 | simple-banner (WordPress plugin) | The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2021-24594 | google-language-translator (WordPress plugin) | The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before | medium | 4.8 | 1% |
| CVE-2021-24598 | testimonial-builder (WordPress plugin) | The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cros | medium | 4.8 | 1% |
| CVE-2021-24608 | formidable-form-builder (WordPress plugin) | The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its F | medium | 4.8 | 1% |
| CVE-2021-24616 | addtoany-share-buttons (WordPress plugin) | The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privileg | medium | 4.8 | 1% |
| CVE-2021-24658 | erident-custom-login-and-dashboard (WordPress plugin) | The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users t | medium | 4.8 | 1% |
| CVE-2021-24710 | print-o-matic (WordPress plugin) | The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow | medium | 4.8 | 1% |
| CVE-2021-24830 | advanced-access-manager (WordPress plugin) | The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege | medium | 4.8 | 1% |
| CVE-2021-24963 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin | medium | 4.8 | 1% |
| CVE-2022-3350 | contact-bank (WordPress plugin) | The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege us | medium | 4.8 | 1% |
| CVE-2024-1852 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all ver | high | 7.2 | 1% |
| CVE-2021-24346 | stock-in-\&-out (WordPress plugin) | The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch | medium | 5.4 | 1% |
| CVE-2021-24558 | project-status (WordPress plugin) | The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape | medium | 5.4 | 1% |