Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2426 | thinkific-uploader (WordPress plugin) | The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-2709 | float-to-top-button (WordPress plugin) | The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-3021 | slickr-flickr (WordPress plugin) | The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to p | medium | 4.8 | 1% |
| CVE-2021-32856 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2023-43341 | evolutioncms/evolution | Evolution CMS Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2024-13634 | post-sync (WordPress plugin) | The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 6.1 | 1% |
| CVE-2020-22392 | intelliants/subrion | Cross Site Scripting in Subrion CMS | medium | 5.4 | 1% |
| CVE-2022-3139 | we\'re-open (WordPress plugin) | The We’re Open! WordPress plugin before 1.42 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2024-0604 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all v | medium | 4.4 | 1% |
| CVE-2021-27915 | mautic/core | Mautic vulnerable to stored cross-site scripting in description field | high | 7.6 | 1% |
| CVE-2023-38491 | getkirby/cms | Cross-site scripting (XSS) from MIME type auto-detection of uploaded files | medium | 5.7 | 1% |
| CVE-2021-24232 | advanced-booking-calendar (WordPress plugin) | The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, le | medium | 5.4 | 1% |
| CVE-2021-24277 | rss-for-yandex-turbo (WordPress plugin) | The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before output | medium | 5.4 | 1% |
| CVE-2021-24302 | hana-flv-player (WordPress plugin) | The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within | medium | 5.4 | 1% |
| CVE-2021-24306 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, v | medium | 5.4 | 1% |
| CVE-2021-24326 | all-404-redirect-to-homepage (WordPress plugin) | The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated r | medium | 5.4 | 1% |
| CVE-2021-24439 | browser-screenshots (WordPress plugin) | The Browser Screenshots WordPress plugin before 1.7.6 allowed authenticated users with a role as low as Contributor to perform Stored Cross- | medium | 5.4 | 1% |
| CVE-2021-24443 | youzify (WordPress plugin) | The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not | medium | 5.4 | 1% |
| CVE-2021-24464 | youtube-embed\,-playlist-and-popup (WordPress plugin) | The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode o | medium | 5.4 | 1% |
| CVE-2021-24476 | steam-group-viewer (WordPress plugin) | The Steam Group Viewer WordPress plugin through 2.1 does not sanitise or escape its "Steam Group Address" settings before outputting it in t | medium | 5.4 | 1% |
| CVE-2021-24478 | bookshelf (WordPress plugin) | The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page | medium | 5.4 | 1% |
| CVE-2021-24505 | forms (WordPress plugin) | The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vu | medium | 5.4 | 1% |
| CVE-2021-24512 | video-posts-webcam-recorder (WordPress plugin) | The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one | medium | 5.4 | 1% |
| CVE-2021-24523 | daily-prayer-time (WordPress plugin) | The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page | medium | 5.4 | 1% |
| CVE-2021-24529 | grid-gallery (WordPress plugin) | The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries whe | medium | 5.4 | 1% |
| CVE-2021-24538 | current-book (WordPress plugin) | The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title, then does | medium | 5.4 | 1% |
| CVE-2021-24544 | motopress-slider-lite (WordPress plugin) | The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site | medium | 5.4 | 1% |
| CVE-2021-24547 | kn-fix-your-title (WordPress plugin) | The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field. | medium | 5.4 | 1% |
| CVE-2021-24548 | mimetic-books (WordPress plugin) | The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publishe | medium | 5.4 | 1% |
| CVE-2021-24564 | scroll-top (WordPress plugin) | The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes | medium | 5.4 | 1% |
| CVE-2021-24577 | coming-soon-and-maintenance-mode (WordPress plugin) | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when s | medium | 5.4 | 1% |
| CVE-2021-24587 | splash-header (WordPress plugin) | The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboa | medium | 5.4 | 1% |
| CVE-2021-24593 | business-hours-indicator (WordPress plugin) | The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it i | medium | 5.4 | 1% |
| CVE-2021-24605 | custom-post-view-generator (WordPress plugin) | The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not | medium | 5.4 | 1% |
| CVE-2021-24654 | user-registration (WordPress plugin) | The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted di | medium | 5.4 | 1% |
| CVE-2021-24927 | my-calendar (WordPress plugin) | The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (availa | medium | 5.4 | 1% |
| CVE-2021-24969 | download-manager (WordPress plugin) | The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pag | medium | 5.4 | 1% |
| CVE-2024-10146 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, | medium | 5.4 | 1% |
| CVE-2019-17433 | encore/laravel-admin | z-song laravel-admin XSS via the Slug or Name on the Roles screen | medium | 4.8 | 1% |
| CVE-2021-24691 | quiz-and-survey-master (WordPress plugin) | The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which | medium | 4.8 | 1% |
| CVE-2023-5530 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2021-41924 | krayin/laravel-crm | Cross-site Scripting in krayin/laravel-crm | medium | 6.1 | 1% |
| CVE-2022-3896 | wp-affiliate-platform (WordPress plugin) | The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to | medium | 6.1 | 1% |
| CVE-2022-40193 | awesome-filterable-portfolio (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress. | medium | 6.1 | 1% |
| CVE-2023-6627 | wp-go-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attacke | medium | 6.1 | 1% |
| CVE-2021-27676 | centreon/centreon | Cross-site scripting in Centreon | medium | 5.4 | 1% |
| CVE-2022-0348 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 5.4 | 1% |
| CVE-2022-0510 | pimcore/pimcore | Cross-site Scripting pimcore | medium | 5.4 | 1% |
| CVE-2022-0941 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2018-10234 | ultimate-member (WordPress plugin) | Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Cust | medium | 4.8 | 1% |