Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24624 | mp3-audio-player-for-music\,-radio-\&-podcast (WordPress plugin) | The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of | medium | 4.8 | 1% |
| CVE-2021-24715 | wp-sitemap-page (WordPress plugin) | The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 1% |
| CVE-2021-24722 | restaurant-menu (WordPress plugin) | The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, whi | medium | 4.8 | 1% |
| CVE-2021-24736 | shared-files (WordPress plugin) | The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before | medium | 4.8 | 1% |
| CVE-2021-24740 | tutor-lms (WordPress plugin) | The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow hig | medium | 4.8 | 1% |
| CVE-2021-24789 | flat-preloader (WordPress plugin) | The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, whi | medium | 4.8 | 1% |
| CVE-2021-24793 | wpematico-rss-feed-fetcher (WordPress plugin) | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an at | medium | 4.8 | 1% |
| CVE-2025-49557 | magento/community-edition, magento/project-community-edition | Magento Cross-site Scripting vulnerability | high | 8.7 | 1% |
| CVE-2023-5060 | librenms/librenms | Cross site scripting in librenms | high | 8.4 | 1% |
| CVE-2021-27911 | mautic/core | XSS vulnerability on contacts view | high | 8.3 | 1% |
| CVE-2023-4422 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | medium | 6.8 | 1% |
| CVE-2024-34081 | mantisbt/mantisbt | Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting | medium | 6.6 | 1% |
| CVE-2023-28475 | concrete5/concrete5 | Reflected cross site scripting | medium | 6.1 | 1% |
| CVE-2020-36709 | page-builder-kingcomposer (WordPress plugin) | The Page Builder: KingComposer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via via shortcode in versions before 2.9.4 | medium | 5.5 | 1% |
| CVE-2021-4172 | showdoc/showdoc | Cross-site Scripting in showdoc | medium | 5.4 | 1% |
| CVE-2022-0256 | pimcore/pimcore | pimcore is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-4321 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.3 | 1% |
| CVE-2022-0447 | post-grid (WordPress plugin) | The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response | medium | 6.4 | 1% |
| CVE-2020-19709 | feehi/feehicms | Cross-site scripting in feehicms | medium | 6.1 | 1% |
| CVE-2020-22330 | intelliants/subrion | Subrion Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2022-0938 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2017-8376 | genix/cms | GeniXCMS Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2022-0395 | remdex/livehelperchat | Cross-site Scripting in LiveHelperChat | medium | 5.4 | 1% |
| CVE-2006-10001 | subscribe-to-comments (WordPress plugin) | A vulnerability, which was classified as problematic, was found in Subscribe to Comments Plugin up to 2.0.7 on WordPress. This affects an un | low | 3.5 | 1% |
| CVE-2023-28819 | concrete5/concrete5 | Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names | low | 3.5 | 1% |
| CVE-2021-24487 | st-daily-tip (WordPress plugin) | The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' set | high | 8.8 | 1% |
| CVE-2022-41706 | spatie/browsershot | Browsershot does not validate URL protocols passed to Browsershot URL method | high | 8.2 | 1% |
| CVE-2022-43984 | spatie/browsershot | Browsershot version 3.57.3 vulnerable to improper input validation | medium | 6.1 | 1% |
| CVE-2022-2215 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2024-11370 | subaccounts-for-woocommerce (WordPress plugin) | The Subaccounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without | medium | 6.1 | 1% |
| CVE-2022-34297 | yiisoft/yii2-gii | Yii2 Gii Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2021-24516 | planso-forms (WordPress plugin) | The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high priv | medium | 4.8 | 1% |
| CVE-2023-36806 | contao/core-bundle | Cross site scripting via input unit widget | medium | 6.6 | 1% |
| CVE-2017-7390 | movingbytes/social-network | SocialNetwork Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2024-3469 | generatepress (WordPress plugin) | The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and inc | medium | 6.1 | 1% |
| CVE-2021-25048 | kingcomposer (WordPress plugin) | The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing | medium | 5.4 | 1% |
| CVE-2017-20177 | wangguard (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress. Affected by this issue is the f | low | 3.5 | 1% |
| CVE-2021-24292 | happy-addons-for-elementor (WordPress plugin) | The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number o | medium | 5.4 | 1% |
| CVE-2023-5566 | smpl-shortcodes (WordPress plugin) | The Simple Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0 | medium | 6.4 | 1% |
| CVE-2022-0539 | ptrofimov/beanstalk_console | Cross-site Scripting in Beanstalk console | medium | 6.3 | 1% |
| CVE-2022-1322 | coming-soon (WordPress plugin) | The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow hig | medium | 4.8 | 1% |
| CVE-2022-2361 | wp-social-chat (WordPress plugin) | The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2021-34625 | wp-upload-restriction (WordPress plugin) | A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject | medium | 6.4 | 1% |
| CVE-2023-28332 | moodle/moodle | Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional | medium | 6.1 | 1% |
| CVE-2023-45819 | tinymce/tinymce | TinyMCE XSS vulnerability in notificationManager.open API | medium | 6.1 | 1% |
| CVE-2024-11371 | theatre (WordPress plugin) | The Theater for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appro | medium | 6.1 | 1% |
| CVE-2024-29644 | dcat/laravel-admin | dcat-admin Cross Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-0387 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 5.4 | 1% |
| CVE-2022-0950 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2024-12585 | propertyhive (WordPress plugin) | The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 1% |