Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-25050 | harvesthq/chosen | Harvest Chosen vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-1530 | remdex/livehelperchat | An attacker can execute malicious javascript in Live Helper Chat | medium | 6.1 | 1% |
| CVE-2023-33195 | craftcms/cms | Craft CMS XSS in RSS widget feed | medium | 6.1 | 1% |
| CVE-2024-0611 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slides callback functi | medium | 4.4 | 1% |
| CVE-2023-5162 | options-for-twenty-seventeen (WordPress plugin) | The Options for Twenty Seventeen plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social-links' shortcode in versions | medium | 6.4 | 1% |
| CVE-2021-24309 | weekly-schedule (WordPress plugin) | The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a u | medium | 5.4 | 1% |
| CVE-2021-24412 | html5-audio-player (WordPress plugin) | The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, all | medium | 5.4 | 1% |
| CVE-2021-24413 | easy-twitter-feed (WordPress plugin) | The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a rol | medium | 5.4 | 1% |
| CVE-2021-24672 | one-user-avatar (WordPress plugin) | The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a rol | medium | 5.4 | 1% |
| CVE-2021-24682 | cool-tag-cloud (WordPress plugin) | The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users | medium | 5.4 | 1% |
| CVE-2021-24716 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjus | medium | 5.4 | 1% |
| CVE-2021-24723 | wp-reactions-lite (WordPress plugin) | The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient | medium | 5.4 | 1% |
| CVE-2021-24732 | dearflip (WordPress plugin) | The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode befor | medium | 5.4 | 1% |
| CVE-2021-24734 | compact-wp-audio-player (WordPress plugin) | The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a | medium | 5.4 | 1% |
| CVE-2021-24760 | pdf-viewer-block-for-gutenberg (WordPress plugin) | The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow users with a role as | medium | 5.4 | 1% |
| CVE-2022-3000 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting via LayoutEditor module | medium | 5.4 | 1% |
| CVE-2022-3004 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow module | medium | 5.4 | 1% |
| CVE-2022-3005 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy module | medium | 5.4 | 1% |
| CVE-2018-6357 | acurax-social-media-widget (WordPress plugin) | The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via th | high | 8.8 | 1% |
| CVE-2021-43324 | librenms/librenms | Cross-site Scripting in LibreNMS | medium | 6.1 | 1% |
| CVE-2020-1691 | moodle/moodle | Moodle XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2022-0426 | product-feed-pro-for-woocommerce (WordPress plugin) | The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an a | medium | 5.4 | 1% |
| CVE-2022-4577 | easy-testimonials (WordPress plugin) | The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 1% |
| CVE-2022-4824 | wp-blog-and-widget (WordPress plugin) | The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2023-0174 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/ | medium | 5.4 | 1% |
| CVE-2022-3441 | rock-convert (WordPress plugin) | The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 1% |
| CVE-2017-9071 | modx/revolution | MODX Revolution XSS via HTTP Host header | medium | 4.7 | 1% |
| CVE-2023-3081 | wp-mail-logging (WordPress plugin) | The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1 | high | 7.2 | 1% |
| CVE-2020-36711 | avada (WordPress theme) | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, | medium | 6.4 | 1% |
| CVE-2021-34641 | wp-seopress (WordPress plugin) | The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleD | medium | 6.4 | 1% |
| CVE-2021-44277 | librenms/librenms | Cross-site Scripting in LibreNMS | medium | 6.1 | 1% |
| CVE-2021-44279 | librenms/librenms | Cross-site Scripting in LibreNMS | medium | 6.1 | 1% |
| CVE-2022-36347 | alpine-photo-tile-for-pinterest (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at Wor | medium | 4.8 | 1% |
| CVE-2024-56517 | tltneon/lgsl | LGSL has a reflected XSS at /lgsl_files/lgsl_list.php | medium | 0.0 | 1% |
| CVE-2021-24920 | statcounter (WordPress plugin) | The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high p | medium | 4.8 | 1% |
| CVE-2024-36676 | ssddanbrown/bookstack | BookStack Incorrect Access Control vulnerability | high | 8.2 | 1% |
| CVE-2021-24982 | child-theme-generator (WordPress plugin) | The Child Theme Generator WordPress plugin through 2.2.7 does not sanitise escape the parade parameter before outputting it back, leading to | medium | 6.4 | 1% |
| CVE-2023-2305 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_ | medium | 6.4 | 1% |
| CVE-2021-24250 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in | medium | 5.4 | 1% |
| CVE-2022-2386 | crowdsignal-dashboard (WordPress plugin) | The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2022-2448 | resmush.it-image-optimizer (WordPress plugin) | The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-2629 | top-bar (WordPress plugin) | The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which | medium | 4.8 | 1% |
| CVE-2022-2635 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2025-46349 | yeswiki/yeswiki | YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting | high | 7.6 | 1% |
| CVE-2015-8759 | typo3/cms | TYPO3 Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2018-5651 | dark-mode (WordPress plugin) | An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_start parameter. | medium | 4.8 | 1% |
| CVE-2018-5652 | dark-mode (WordPress plugin) | An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter. | medium | 4.8 | 1% |
| CVE-2021-24489 | request-a-quote (WordPress plugin) | The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading | medium | 4.8 | 1% |
| CVE-2021-24612 | sociable (WordPress plugin) | The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboar | medium | 4.8 | 1% |
| CVE-2021-24622 | customer-service-software-\&-support-ticket-system (WordPress plugin) | The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputti | medium | 4.8 | 1% |