Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-41994 | baserproject/basercms | baserCMS vulnerable to stored Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2022-42486 | baserproject/basercms | baserCMS vulnerable to stored Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2024-37259 | wp-extended (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Too | high | 7.1 | 1% |
| CVE-2017-18259 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2017-9838 | dolibarr/dolibarr | Dolibarr Cross-Site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2021-24301 | hotjar-connecticator (WordPress plugin) | The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. | medium | 5.4 | 1% |
| CVE-2021-24357 | foogallery (WordPress plugin) | In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is no | medium | 5.4 | 1% |
| CVE-2021-24369 | getpaid (WordPress plugin) | In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and | medium | 5.4 | 1% |
| CVE-2021-24408 | prismatic (WordPress plugin) | The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low | medium | 5.4 | 1% |
| CVE-2021-24414 | video-player-for-youtube (WordPress plugin) | The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users wit | medium | 5.4 | 1% |
| CVE-2021-24420 | request-a-quote (WordPress plugin) | The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, | medium | 5.4 | 1% |
| CVE-2021-24468 | leaflet-map (WordPress plugin) | The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, whi | medium | 5.4 | 1% |
| CVE-2021-24486 | simple-social-media-share-buttons (WordPress plugin) | The Simple Social Media Share Buttons – Social Sharing for Everyone WordPress plugin before 3.2.3 did not escape the align and like_button_s | medium | 5.4 | 1% |
| CVE-2021-24503 | popular-brand-icons---simple-icons (WordPress plugin) | The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as | medium | 5.4 | 1% |
| CVE-2021-24509 | page-view-count (WordPress plugin) | The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as | medium | 5.4 | 1% |
| CVE-2021-24513 | form-builder (WordPress plugin) | The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high | medium | 5.4 | 1% |
| CVE-2021-24517 | stop-spammers (WordPress plugin) | The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowin | medium | 5.4 | 1% |
| CVE-2021-24525 | shortcodes-ultimate (WordPress plugin) | The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. N | medium | 5.4 | 1% |
| CVE-2021-24528 | fluentsmtp (WordPress plugin) | The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin e | medium | 5.4 | 1% |
| CVE-2021-24534 | phonetrack-meu-site-manager (WordPress plugin) | The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in a | medium | 5.4 | 1% |
| CVE-2021-24540 | wonder-video-embed (WordPress plugin) | The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users w | medium | 5.4 | 1% |
| CVE-2021-24541 | wonder-pdf-embed (WordPress plugin) | The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with | medium | 5.4 | 1% |
| CVE-2021-24568 | addtoany-share-buttons (WordPress plugin) | The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, | medium | 5.4 | 1% |
| CVE-2021-24571 | hd-quiz (WordPress plugin) | The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, | medium | 5.4 | 1% |
| CVE-2021-24576 | easy-accordion (WordPress plugin) | The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion. | medium | 5.4 | 1% |
| CVE-2021-24582 | thinktwit (WordPress plugin) | The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it its settings page, le | medium | 5.4 | 1% |
| CVE-2021-24590 | cookie-notice-\&-consent-banner-for-gdpr-\&-ccpa-compliance (WordPress plugin) | The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent inj | medium | 5.4 | 1% |
| CVE-2021-24591 | highlight (WordPress plugin) | The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scr | medium | 5.4 | 1% |
| CVE-2021-24597 | you-shang (WordPress plugin) | The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues | medium | 5.4 | 1% |
| CVE-2021-24601 | wpfront-notification-bar (WordPress plugin) | The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high | medium | 5.4 | 1% |
| CVE-2021-24603 | site-reviews (WordPress plugin) | The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could a | medium | 5.4 | 1% |
| CVE-2021-24634 | recipe-card-blocks-for-gutenberg-\&-elementor (WordPress plugin) | The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Car | medium | 5.4 | 1% |
| CVE-2021-24637 | fonts (WordPress plugin) | The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as ro | medium | 5.4 | 1% |
| CVE-2021-24640 | gutenslider (WordPress plugin) | The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow us | medium | 5.4 | 1% |
| CVE-2021-24643 | wp-map-block (WordPress plugin) | The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as l | medium | 5.4 | 1% |
| CVE-2021-24670 | coolclock (WordPress plugin) | The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor tope | medium | 5.4 | 1% |
| CVE-2021-24671 | mx-time-zone-clocks (WordPress plugin) | The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allo | medium | 5.4 | 1% |
| CVE-2021-24678 | tooltip-glossary (WordPress plugin) | The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a | medium | 5.4 | 1% |
| CVE-2021-24680 | wp-travel-engine (WordPress plugin) | The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pr | medium | 5.4 | 1% |
| CVE-2021-24690 | chained-quiz (WordPress plugin) | The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings. | medium | 5.4 | 1% |
| CVE-2021-24699 | easy-media-download (WordPress plugin) | The Easy Media Download WordPress plugin before 1.1.7 does not escape the text argument of its shortcode, which could allow users with a rol | medium | 5.4 | 1% |
| CVE-2021-24712 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars. | medium | 5.4 | 1% |
| CVE-2021-24729 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role a | medium | 5.4 | 1% |
| CVE-2021-24738 | logo-carousel (WordPress plugin) | The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with | medium | 5.4 | 1% |
| CVE-2021-24743 | podcast-subscribe-buttons (WordPress plugin) | The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored | medium | 5.4 | 1% |
| CVE-2021-24745 | about-author-box (WordPress plugin) | The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in a | medium | 5.4 | 1% |
| CVE-2021-24751 | generateblocks (WordPress plugin) | The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow | medium | 5.4 | 1% |
| CVE-2021-24759 | pdf.js-viewer (WordPress plugin) | The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, which could allow user | medium | 5.4 | 1% |
| CVE-2021-24812 | betterlinks (WordPress plugin) | The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Si | medium | 5.4 | 1% |
| CVE-2021-24817 | ultimate-nofollow (WordPress plugin) | The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with | medium | 5.4 | 1% |