Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-4602 | namaste\!-lms (WordPress plugin) | The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and | medium | 6.1 | 1% |
| CVE-2023-4603 | star-cloudprnt-for-woocommerce (WordPress plugin) | The Star CloudPRNT for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'printersettings' parameter | medium | 6.1 | 1% |
| CVE-2023-4981 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-4982 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-43695 | concrete5/concrete5 | Concrete CMS Cross-site Scripting vulnerability | medium | 4.8 | 1% |
| CVE-2021-24126 | envira-gallery (WordPress plugin) | Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitis | medium | 5.4 | 1% |
| CVE-2022-0706 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could a | medium | 4.8 | 1% |
| CVE-2022-2574 | meks-easy-social-share (WordPress plugin) | The Meks Easy Social Share WordPress plugin before 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2023-5127 | wp-font-awesome (WordPress plugin) | The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 | medium | 6.4 | 1% |
| CVE-2022-4905 | wpcloud/wp-stateless, stateless-media-plugin (WordPress plugin) | Cross-site Scripting in UDX Stateless Media Plugin | medium | 6.1 | 1% |
| CVE-2023-0087 | swifty-page-manager (WordPress plugin) | The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ p | medium | 5.5 | 1% |
| CVE-2022-4617 | microweber/microweber | Microweber vulnerable to Reflected Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2021-24246 | workscout (WordPress plugin), workscout-core (WordPress plugin) | The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send | medium | 5.4 | 1% |
| CVE-2021-24334 | instant-images---one-click-unsplash-uploads (WordPress plugin) | The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download | medium | 5.4 | 1% |
| CVE-2021-24386 | wp-svg-images (WordPress plugin) | The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ | medium | 5.4 | 1% |
| CVE-2020-13980 | opencart/opencart | OpenCart Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2022-27859 | nd-travel (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o. Travel Manageme | medium | 4.1 | 1% |
| CVE-2020-5223 | privatebin/privatebin | Persistent XSS vulnerability in filename of attached file in PrivateBin | medium | 6.1 | 1% |
| CVE-2022-1932 | rezgo-online-booking (WordPress plugin) | The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, l | medium | 6.1 | 1% |
| CVE-2017-18601 | ibps-online-exam (WordPress plugin) | The examapp plugin 1.0 for WordPress has XSS via exam input text fields. | medium | 5.4 | 1% |
| CVE-2021-24129 | portfolio-post (WordPress plugin) | Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Si | medium | 5.4 | 1% |
| CVE-2021-24208 | wp-page-builder (WordPress plugin) | The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScrip | medium | 5.4 | 1% |
| CVE-2019-25145 | contact-form (WordPress plugin) | The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.p | high | 7.2 | 1% |
| CVE-2018-17138 | jibu-pro (WordPress plugin) | The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name | medium | 5.4 | 1% |
| CVE-2018-17140 | quizlord (WordPress plugin) | The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php. | medium | 5.4 | 1% |
| CVE-2022-38145 | silverstripe/versioned-admin | Stored XSS in Compare Mode | medium | 5.4 | 1% |
| CVE-2021-24445 | my-site-audit (WordPress plugin) | The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high priv | medium | 5.5 | 1% |
| CVE-2021-24128 | team-members (WordPress plugin) | Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vuln | medium | 5.4 | 1% |
| CVE-2021-4018 | snipe/snipe-it | snipe-it is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-37248 | craftcms/cms | Craft CMS Cross site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-43556 | concrete5/concrete5 | Concrete CMS vulnerable to cross-site scripting in the text input field | medium | 4.2 | 1% |
| CVE-2023-5161 | modal-window (WordPress plugin) | The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 du | medium | 6.4 | 1% |
| CVE-2023-36828 | statamic/cms | Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG | medium | 5.5 | 1% |
| CVE-2021-4132 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-24134 | constant-contact-forms (WordPress plugin) | Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored | medium | 4.8 | 1% |
| CVE-2021-24686 | svg-support (WordPress plugin) | The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which | medium | 4.8 | 1% |
| CVE-2021-25049 | mobile-events-manager (WordPress plugin) | The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users | medium | 4.8 | 1% |
| CVE-2022-0884 | profile-builder (WordPress plugin) | The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high pr | medium | 4.8 | 1% |
| CVE-2022-0958 | mark-posts (WordPress plugin) | The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site | medium | 4.8 | 1% |
| CVE-2024-13628 | wp-pricing-table (WordPress plugin) | The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 1% |
| CVE-2023-5318 | microweber/microweber | Microweber uses hard coded credentials | medium | 5.8 | 1% |
| CVE-2023-33196 | craftcms/cms | Craft CMS stored XSS in review volume | medium | 5.5 | 1% |
| CVE-2018-1999021 | gleez/cms | Gleez Cms Cross-site Scripting in Profile Page | medium | 5.4 | 1% |
| CVE-2021-24127 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was v | medium | 5.4 | 1% |
| CVE-2022-1755 | svg-support (WordPress plugin) | The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as aut | medium | 5.4 | 1% |
| CVE-2018-5667 | read-and-understood (WordPress plugin) | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_va | medium | 4.8 | 1% |
| CVE-2018-5668 | read-and-understood (WordPress plugin) | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_va | medium | 4.8 | 1% |
| CVE-2021-24330 | cartflows (WordPress plugin) | The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixe | medium | 4.8 | 1% |
| CVE-2021-24331 | smooth-scroll-page-up\/down-buttons (WordPress plugin) | The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psb_distance | medium | 4.8 | 1% |
| CVE-2021-24450 | profilepress (WordPress plugin) | The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sani | medium | 4.8 | 1% |