Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24918 | smash-balloon-social-post-feed (WordPress plugin) | The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's s | medium | 5.4 | 1% |
| CVE-2021-25061 | wp-booking-system (WordPress plugin) | The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page. | medium | 5.4 | 1% |
| CVE-2022-2040 | brizy (WordPress plugin) | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contrib | medium | 5.4 | 1% |
| CVE-2022-2041 | brizy (WordPress plugin) | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Con | medium | 5.4 | 1% |
| CVE-2022-23800 | joomla/filter | Cross-site Scripting (XSS) within joomla/filter class | medium | 6.1 | 1% |
| CVE-2021-24961 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of i | medium | 5.4 | 1% |
| CVE-2023-6970 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and | medium | 6.1 | 1% |
| CVE-2015-10090 | landing-pages (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in Landing Pages Plugin up to 1.8.7 on WordPress. Affected by this issu | low | 3.5 | 1% |
| CVE-2022-3440 | rock-convert (WordPress plugin) | The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specifi | medium | 6.1 | 1% |
| CVE-2022-37250 | craftcms/cms | Craft CMS Stored Cross-site Scripting in User Addresses Title | medium | 5.4 | 1% |
| CVE-2022-3991 | photospace (WordPress plugin) | The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() | medium | 6.4 | 1% |
| CVE-2019-16725 | joomla/joomla-cms | Joomla! XSS in Default Templates | medium | 6.1 | 1% |
| CVE-2021-24561 | wp-sms (WordPress plugin) | The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, le | medium | 5.4 | 1% |
| CVE-2021-4367 | flo-forms (WordPress plugin) | The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using | medium | 6.4 | 1% |
| CVE-2023-4597 | wp-slimstat (WordPress plugin) | The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2010-10002 | simplesamlphp/simplesamlphp-module-openid | SimpleSAMLphp simplesamlphp-module-openid | medium | 6.1 | 1% |
| CVE-2020-36607 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-2115 | popup-anything (WordPress plugin) | The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, lead | medium | 6.1 | 1% |
| CVE-2024-34105 | magento/community-edition | Magento Open Source Cross-Site Scripting (XSS) vulnerability | medium | 4.8 | 1% |
| CVE-2024-2908 | call-now-button (WordPress plugin) | The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.3 | 1% |
| CVE-2021-24502 | wp-maps (WordPress plugin) | The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a St | medium | 4.8 | 1% |
| CVE-2021-24856 | shared-files (WordPress plugin) | The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high priv | medium | 4.8 | 1% |
| CVE-2015-10013 | taxonomy-switcher (WordPress plugin) | A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affecte | low | 3.5 | 1% |
| CVE-2023-4978 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-4663 | members-import (WordPress plugin) | The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in v | medium | 5.5 | 1% |
| CVE-2018-16551 | lavalite/cms | Stored XSS in LavaLite 5.5 | medium | 5.4 | 1% |
| CVE-2022-1010 | login-using-wordpress-users (WordPress plugin) | The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which c | medium | 4.8 | 1% |
| CVE-2022-1990 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2022-3237 | wp-contact-slider (WordPress plugin) | The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin t | medium | 4.8 | 1% |
| CVE-2022-3408 | wp-word-count (WordPress plugin) | The WP Word Count WordPress plugin through 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2022-43983 | spatie/browsershot | Browsershot vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2024-2761 | genesis-blocks (WordPress plugin) | The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at | medium | 6.8 | 1% |
| CVE-2021-3862 | icecoder/icecoder | icecoder is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-32737 | sulu/sulu | XSS Injection in Media Collection Title was possible | medium | 4.8 | 1% |
| CVE-2023-5660 | sendpress (WordPress plugin) | The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 1% |
| CVE-2022-43692 | concrete5/concrete5 | Concrete CMS vulnerable to Reflected Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-43694 | concrete5/concrete5 | Concrete CMS vulnerable to Reflected Cross-site Scripting via image manipulation library | medium | 6.1 | 1% |
| CVE-2022-43967 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-site Scripting via multilingual report | medium | 6.1 | 1% |
| CVE-2022-43968 | concrete5/concrete5 | Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons | medium | 6.1 | 1% |
| CVE-2022-0260 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 5.4 | 1% |
| CVE-2022-2871 | notrinos/notrinos-erp | NotrinosERP Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-38975 | ec-cube/ec-cube | EC-CUBE DOM-based cross-site scripting vulnerability | medium | 5.4 | 1% |
| CVE-2021-24315 | givewp (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field o | medium | 4.8 | 1% |
| CVE-2021-24260 | addons-for-elementor (WordPress plugin) | The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2021-24261 | ht-mega (WordPress plugin) | The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored C | medium | 5.4 | 1% |
| CVE-2021-24263 | powerpack-addons-for-elementor (WordPress plugin) | The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable | medium | 5.4 | 1% |
| CVE-2021-24267 | all-in-one-addons-for-elementor (WordPress plugin) | The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Sit | medium | 5.4 | 1% |
| CVE-2020-13688 | drupal/core | Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances. An attacker could | medium | 6.1 | 1% |
| CVE-2020-35571 | mantisbt/mantisbt | MantisBT XSS in manage_custom_field_update.php | medium | 6.1 | 1% |
| CVE-2023-28331 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | medium | 6.1 | 1% |