Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24421 | jobsearch-wp-job-board (WordPress plugin) | The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputti | medium | 5.4 | 1% |
| CVE-2015-10078 | resend-welcome-email (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress. This issue | low | 3.5 | 1% |
| CVE-2016-15027 | post-duplicator (WordPress plugin) | A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the | low | 3.5 | 1% |
| CVE-2017-9336 | wp-editor.md (WordPress plugin) | The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post. | medium | 6.1 | 1% |
| CVE-2022-2116 | contact-form-db---elementor (WordPress plugin) | The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, le | medium | 6.1 | 1% |
| CVE-2022-2378 | easy-student-results (WordPress plugin) | The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2022-34857 | sp-client-document-manager (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress | medium | 6.1 | 1% |
| CVE-2023-0428 | watu-quiz (WordPress plugin) | The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 6.1 | 1% |
| CVE-2019-17203 | nilsteampassnet/teampass | TeamPass Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2019-17204 | nilsteampassnet/teampass | TeamPass Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-24180 | related-posts (WordPress plugin) | Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scri | medium | 5.4 | 1% |
| CVE-2021-24187 | seo-redirection (WordPress plugin) | The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scri | medium | 5.4 | 1% |
| CVE-2024-2101 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appoin | medium | 5.7 | 1% |
| CVE-2017-1000495 | quickapps/cms | QuickApps CMS Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-0506 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2017-14740 | genix/cms | GeniXCMS Cross-site scripting (XSS) vulnerability | medium | 4.8 | 1% |
| CVE-2019-19979 | wp-maintenance (WordPress plugin) | A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject mal | high | 8.8 | 1% |
| CVE-2024-10152 | simple-certain-time-to-show-content (WordPress plugin) | The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in | high | 7.1 | 1% |
| CVE-2021-36841 | yith-maintenance-mode (WordPress plugin) | Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable para | medium | 6.9 | 1% |
| CVE-2022-43121 | intelliants/subrion | Subrion CMS is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2023-5128 | tcd-google-maps (WordPress plugin) | The TCD Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'map' shortcode in versions up to, and including, | medium | 6.4 | 1% |
| CVE-2021-24424 | wp-reset (WordPress plugin) | The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when crea | medium | 5.4 | 1% |
| CVE-2023-44762 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-2567 | form-builder-cp (WordPress plugin) | The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-2710 | scroll-to-top (WordPress plugin) | The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin t | medium | 4.8 | 1% |
| CVE-2024-47523 | librenms/librenms | LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature | high | 7.5 | 1% |
| CVE-2022-2430 | visualcomposer (WordPress plugin) | The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versio | medium | 6.4 | 1% |
| CVE-2022-2516 | visualcomposer (WordPress plugin) | The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in ver | medium | 6.4 | 1% |
| CVE-2022-2936 | image-hover-effects-ultimate (WordPress plugin) | The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values that can be added t | medium | 6.4 | 1% |
| CVE-2022-2937 | image-hover-effects-ultimate (WordPress plugin) | The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that c | medium | 6.4 | 1% |
| CVE-2023-5667 | tabs-pro (WordPress plugin) | The Tab Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and in | medium | 6.4 | 1% |
| CVE-2022-28378 | craftcms/cms | Cross-site Scripting in craftcms/cms | medium | 6.1 | 1% |
| CVE-2021-24168 | easy-contact-form-pro (WordPress plugin) | The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, | medium | 5.4 | 1% |
| CVE-2021-24211 | wordpress-related-posts (WordPress plugin) | The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the setti | medium | 5.4 | 1% |
| CVE-2023-28474 | concrete5/concrete5 | Stored cross site scripting on saved presets | medium | 5.4 | 1% |
| CVE-2022-4793 | blog-designer (WordPress plugin) | The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a | medium | 5.4 | 1% |
| CVE-2024-39899 | privatebin/privatebin | PrivateBin allows shortening of URLs for other domains | medium | 5.3 | 1% |
| CVE-2020-15245 | sylius/sylius | Ability to switch customer email address on account detail page and stay verified | medium | 4.3 | 1% |
| CVE-2023-5817 | neon-text (WordPress plugin) | The Neon text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's neontext_box shortcode in all versions up t | medium | 6.4 | 1% |
| CVE-2022-2404 | wp-popup-builder (WordPress plugin) | The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 1% |
| CVE-2024-13727 | memberspace (WordPress plugin) | The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 1% |
| CVE-2021-24258 | elements-kit-elementor-addons (WordPress plugin) | The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site | medium | 5.4 | 1% |
| CVE-2021-45919 | studio-42/elfinder | Studio 42 elFinder allows stored XSS | medium | 5.4 | 1% |
| CVE-2021-24332 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege | medium | 4.8 | 1% |
| CVE-2021-24418 | smooth-scroll-page-up\/down-buttons (WordPress plugin) | The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_positioning settings, al | medium | 4.8 | 1% |
| CVE-2021-24419 | wp-youtube-lyte (WordPress plugin) | The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outp | medium | 4.8 | 1% |
| CVE-2021-24425 | mystickymenu (WordPress plugin) | The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not | medium | 4.8 | 1% |
| CVE-2021-24426 | backup-wd (WordPress plugin) | The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputt | medium | 4.8 | 1% |
| CVE-2024-11365 | security-force (WordPress plugin) | The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the | medium | 6.1 | 1% |
| CVE-2023-3565 | nilsteampassnet/teampass | TeamPass Cross-site Scripting vulnerability | medium | 5.4 | 1% |