Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9414 | wp-symposium (WordPress plugin) | The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter. | medium | 6.1 | 4% |
| CVE-2021-41467 | hjue/justwriting | Cross-site scripting in application/controllers/dropbox.php in JustWriting | medium | 6.1 | 4% |
| CVE-2022-0901 | ad-inserter (WordPress plugin) | The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admi | medium | 6.1 | 4% |
| CVE-2014-2995 | twitget (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticat | low | 3.5 | 4% |
| CVE-2016-1000143 | photoxhibit (WordPress plugin) | Reflected XSS in wordpress plugin photoxhibit v2.1.8 | medium | 6.1 | 4% |
| CVE-2018-11709 | wpforo (WordPress plugin) | wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected | medium | 6.1 | 4% |
| CVE-2012-0782 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlie | medium | 4.3 | 4% |
| CVE-2021-24498 | calendar-event-multi-view (WordPress plugin) | The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputt | medium | 6.1 | 4% |
| CVE-2014-9179 | supportezzy-ticket-system (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to in | medium | 4.0 | 3% |
| CVE-2017-17092 | WordPress core | wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might all | medium | 5.4 | 3% |
| CVE-2018-19933 | bolt/bolt | Bolt Cross-site Scripting (XSS) via text input click preview button | medium | 6.1 | 3% |
| CVE-2016-1000141 | page-layout-builder (WordPress plugin) | Reflected XSS in wordpress plugin page-layout-builder v1.9.3 | medium | 6.1 | 3% |
| CVE-2016-1000146 | pondol-formmail (WordPress plugin) | Reflected XSS in wordpress plugin pondol-formmail v1.1 | medium | 6.1 | 3% |
| CVE-2020-7108 | learndash (WordPress plugin) | The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field. | medium | 5.4 | 3% |
| CVE-2010-4536 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary w | medium | 4.3 | 3% |
| CVE-2016-1000138 | indexisto (WordPress plugin) | Reflected XSS in wordpress plugin indexisto v1.0.5 | medium | 6.1 | 3% |
| CVE-2016-1000140 | new-year-firework (WordPress plugin) | Reflected XSS in wordpress plugin new-year-firework v1.1.9 | medium | 6.1 | 3% |
| CVE-2016-1000154 | whizz (WordPress plugin) | Reflected XSS in wordpress plugin whizz v1.0.7 | medium | 6.1 | 3% |
| CVE-2017-17059 | amtythumb (WordPress plugin) | XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to | medium | 6.1 | 3% |
| CVE-2016-1000133 | forget-about-shortcode-buttons (WordPress plugin) | Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1 | medium | 6.1 | 3% |
| CVE-2016-1000136 | heat-trackr (WordPress plugin) | Reflected XSS in wordpress plugin heat-trackr v1.0 | medium | 6.1 | 3% |
| CVE-2019-20204 | postie (WordPress plugin) | The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SV | medium | 5.4 | 3% |
| CVE-2022-0201 | permalink-manager (WordPress plugin), permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escap | medium | 6.1 | 3% |
| CVE-2018-7543 | duplicator (WordPress plugin) | Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows re | medium | 6.1 | 3% |
| CVE-2021-24495 | marmoset-viewer (WordPress plugin) | The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back i | medium | 6.1 | 3% |
| CVE-2019-16931 | visualizer (WordPress plugin) | A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript w | medium | 6.1 | 3% |
| CVE-2019-13478 | yoast-seo (WordPress plugin) | The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions. | critical | 9.8 | 3% |
| CVE-2020-9371 | appointment-booking-calendar (WordPress plugin) | Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar N | medium | 4.8 | 3% |
| CVE-2022-0967 | showdoc/showdoc | Stored Cross-site Scripting in showdoc | medium | 6.9 | 3% |
| CVE-2015-2269 | moodle/moodle | Moodle XSS Vulnerability | low | 0.0 | 3% |
| CVE-2022-1439 | microweber/microweber | Cross-site Scripting in Microweber | medium | 6.3 | 3% |
| CVE-2021-24308 | lifterlms (WordPress plugin) | The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordP | medium | 5.4 | 3% |
| CVE-2019-20210 | citybook (WordPress plugin), easybook (WordPress plugin), townhub (WordPress plugin) | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search q | medium | 6.1 | 3% |
| CVE-2022-0683 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization | medium | 6.1 | 3% |
| CVE-2016-1000129 | defa-online-image-protector (WordPress plugin) | Reflected XSS in wordpress plugin defa-online-image-protector v3.3 | medium | 6.1 | 3% |
| CVE-2008-5278 | WordPress core | Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before | medium | 4.3 | 3% |
| CVE-2019-1010124 | woocommerce-product-feed (WordPress plugin) | WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing them | medium | 5.4 | 3% |
| CVE-2016-1000148 | s3-video (WordPress plugin) | Reflected XSS in wordpress plugin s3-video v0.983 | medium | 6.1 | 3% |
| CVE-2022-0954 | microweber/microweber | Stored Cross-site Scripting in Microweber | medium | 6.8 | 3% |
| CVE-2021-33829 | drupal/core, drupal/drupal | **Update: 2021-06-11: Added CVE-2021-33829 identifier** Drupal core uses the third-party CKEditor library. This library | medium | 6.1 | 3% |
| CVE-2012-6692 | wordpress-seo (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote | medium | 4.3 | 3% |
| CVE-2021-29460 | getkirby/cms | Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby | high | 7.6 | 3% |
| CVE-2019-20209 | citybook (WordPress plugin), easybook (WordPress plugin), townhub (WordPress plugin) | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Refere | high | 7.5 | 3% |
| CVE-2022-2130 | microweber/microweber | Cross-site Scripting in Microweber | medium | 6.1 | 3% |
| CVE-2019-9912 | wp-go-maps (WordPress plugin) | The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO. | medium | 6.1 | 3% |
| CVE-2013-0237 | WordPress core | Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other prod | medium | 4.3 | 3% |
| CVE-2021-24884 | formidable-form-builder (WordPress plugin) | The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.Th | critical | 9.6 | 3% |
| CVE-2018-14059 | pimcore/pimcore | Pimcore XSS Vulnerability | medium | 5.4 | 3% |
| CVE-2018-11564 | pagekit/pagekit | Pagekit Stored Cross-site Scripting | medium | 4.8 | 3% |
| CVE-2022-1153 | layerslider (WordPress plugin) | The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which | medium | 4.8 | 3% |