Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24828 | mortgage-calculator\/loan-calculator (WordPress plugin) | The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode | medium | 5.4 | 1% |
| CVE-2021-24850 | insert-pages (WordPress plugin) | The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by us | medium | 5.4 | 1% |
| CVE-2021-24854 | qr-redirector (WordPress plugin) | The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a | medium | 5.4 | 1% |
| CVE-2021-24855 | display-post-metadata (WordPress plugin) | The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised | medium | 5.4 | 1% |
| CVE-2021-24930 | bookly (WordPress plugin) | The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputtin | medium | 5.4 | 1% |
| CVE-2022-2299 | allow-svg-files (WordPress plugin) | The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author | medium | 5.4 | 1% |
| CVE-2022-2371 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as | medium | 5.4 | 1% |
| CVE-2022-2391 | inspiro-pro (WordPress plugin) | The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to | medium | 5.4 | 1% |
| CVE-2020-23234 | lavalite/cms | Cross Site Scripting in LavaLite CMS | medium | 4.8 | 1% |
| CVE-2022-29406 | wp-team-manager (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team | medium | 4.1 | 1% |
| CVE-2024-13853 | seo-tools (WordPress plugin) | The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2018-5369 | srbtranslatin (WordPress plugin) | The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificat | medium | 4.8 | 1% |
| CVE-2018-5660 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_su | medium | 4.8 | 1% |
| CVE-2018-5662 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title | medium | 4.8 | 1% |
| CVE-2018-5663 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_li | medium | 4.8 | 1% |
| CVE-2018-5665 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height pa | medium | 4.8 | 1% |
| CVE-2018-5666 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color param | medium | 4.8 | 1% |
| CVE-2018-5670 | booking-calendar (WordPress plugin) | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] p | medium | 4.8 | 1% |
| CVE-2018-5671 | booking-calendar (WordPress plugin) | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_ | medium | 4.8 | 1% |
| CVE-2018-5672 | booking-calendar (WordPress plugin) | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] paramet | medium | 4.8 | 1% |
| CVE-2024-56519 | tecnickcom/tcpdf | TCPDF lacks SVG sanitization | medium | 0.0 | 1% |
| CVE-2023-5706 | vk-blocks (WordPress plugin) | The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all | medium | 6.4 | 1% |
| CVE-2023-5740 | wp-facebook-messenger (WordPress plugin) | The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortco | medium | 6.4 | 1% |
| CVE-2021-24427 | w3-total-cache (WordPress plugin) | The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use J | medium | 4.8 | 1% |
| CVE-2022-0674 | kunze-law (WordPress plugin) | The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-0700 | simple-tracking (WordPress plugin) | The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to pe | medium | 4.8 | 1% |
| CVE-2022-0702 | petfinder-listings (WordPress plugin) | The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform | medium | 4.8 | 1% |
| CVE-2022-0703 | gd-mylist (WordPress plugin) | The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2022-0763 | microweber/microweber | Cross-site Scripting in microweber | medium | 4.8 | 1% |
| CVE-2022-0772 | librenms/librenms | Cross site scripting in LibreNMS | medium | 4.8 | 1% |
| CVE-2022-0906 | microweber/microweber | Unrestricted file upload leads to stored cross-site scripting in Microweber | medium | 4.8 | 1% |
| CVE-2022-1324 | event-timeline (WordPress plugin) | The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such a | medium | 4.8 | 1% |
| CVE-2022-2278 | featured-image-from-url (WordPress plugin) | The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could al | medium | 4.8 | 1% |
| CVE-2022-2305 | popups (WordPress plugin) | The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2022-2325 | invitation-based-registrations (WordPress plugin) | The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 1% |
| CVE-2022-2328 | flexi-quote-rotator (WordPress plugin) | The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admi | medium | 4.8 | 1% |
| CVE-2022-2372 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-2395 | weforms (WordPress plugin) | The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform | medium | 4.8 | 1% |
| CVE-2022-2398 | wordpress-comments-fields (WordPress plugin) | The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to pe | medium | 4.8 | 1% |
| CVE-2022-2409 | rough-chart (WordPress plugin) | The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform | medium | 4.8 | 1% |
| CVE-2022-2410 | mtouch-quiz (WordPress plugin) | The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2022-2411 | auto-more-tag (WordPress plugin) | The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2022-2412 | better-tag-cloud (WordPress plugin) | The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2022-2423 | dw-promobar (WordPress plugin) | The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2022-2424 | google-maps-anywhere (WordPress plugin) | The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-2425 | wp-ds-blog-map (WordPress plugin) | The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-2426 | thinkific-uploader (WordPress plugin) | The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-2709 | float-to-top-button (WordPress plugin) | The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-3021 | slickr-flickr (WordPress plugin) | The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to p | medium | 4.8 | 1% |
| CVE-2021-32856 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 6.1 | 1% |