Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24785 | great-quotes (WordPress plugin) | The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow hi | medium | 4.8 | 1% |
| CVE-2021-24787 | client-invoicing-by-sprout-invoices (WordPress plugin) | The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow | medium | 4.8 | 1% |
| CVE-2021-24811 | shop-page-wp (WordPress plugin) | The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to per | medium | 4.8 | 1% |
| CVE-2021-24815 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could al | medium | 4.8 | 1% |
| CVE-2021-24882 | slideshow-gallery (WordPress plugin) | The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" field | medium | 4.8 | 1% |
| CVE-2021-24896 | caldera-forms (WordPress plugin) | The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could a | medium | 4.8 | 1% |
| CVE-2021-24902 | typebot (WordPress plugin) | The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which | medium | 4.8 | 1% |
| CVE-2021-24972 | pixel-cat (WordPress plugin) | The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Si | medium | 4.8 | 1% |
| CVE-2021-24992 | buttonizer (WordPress plugin) | The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attr | medium | 4.8 | 1% |
| CVE-2023-33194 | craftcms/cms | CraftCMS stored XSS in Quick Post widget error message | low | 3.7 | 1% |
| CVE-2020-22765 | nukeviet/nukeviet | NukeViet Cross-site Scripting via the editor in the News module | medium | 6.1 | 1% |
| CVE-2023-4432 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.3 | 1% |
| CVE-2024-7617 | contact-form-to-any-api (WordPress plugin) | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions | high | 7.2 | 1% |
| CVE-2017-8298 | austintoddj/canvas | Canvs Canvas Cross-site Scripting (XSS) via title and content fields | medium | 5.4 | 1% |
| CVE-2023-1755 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-1093 | wp-meta-seo (WordPress plugin) | The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowin | medium | 4.8 | 1% |
| CVE-2022-1094 | amr-users (WordPress plugin) | The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-39325 | baserproject/basercms | baserproject/basercms vulnerable to cross-site scripting (XSS) vulnerability | medium | 4.6 | 1% |
| CVE-2021-24328 | wp-login-security-and-history (WordPress plugin) | The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or val | medium | 6.2 | 1% |
| CVE-2017-20175 | mediawiki/matomo | Cross-site Scripting in DaSchTour matomo-mediawiki-extension | medium | 6.1 | 1% |
| CVE-2021-24423 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privile | medium | 4.8 | 1% |
| CVE-2024-0326 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Link Wrapper functionali | medium | 6.4 | 1% |
| CVE-2022-0372 | bytefury/crater | Cross-site Scripting in Crater Invoice | medium | 5.4 | 1% |
| CVE-2021-24343 | iflychat (WordPress plugin) | The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authent | medium | 4.8 | 1% |
| CVE-2021-24448 | profile-builder (WordPress plugin) | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirec | medium | 4.8 | 1% |
| CVE-2021-24479 | drawblog (WordPress plugin) | The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them back in the page, leadi | medium | 4.8 | 1% |
| CVE-2021-24480 | event-geek (WordPress plugin) | The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its "Use your own " setting before outputting it in the page, lead | medium | 4.8 | 1% |
| CVE-2021-24481 | any-hostname (WordPress plugin) | The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored | medium | 4.8 | 1% |
| CVE-2021-24519 | car-rental-management-system (WordPress plugin) | The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or ed | medium | 4.8 | 1% |
| CVE-2023-4145 | pimcore/customer-management-framework-bundle | pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name | medium | 6.5 | 1% |
| CVE-2021-3977 | hillelcoren/invoice-ninja | invoiceninja is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-2516 | nilsteampassnet/teampass | Cross Site Scripting in nilsteampassnet/teampass | medium | 5.4 | 1% |
| CVE-2023-1374 | solidres (WordPress plugin) | The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in versions up to, and incl | medium | 4.4 | 1% |
| CVE-2020-20589 | feehi/feehicms | FeehiCMS vulnerable to Cross Site Scripting | medium | 6.1 | 1% |
| CVE-2021-24694 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site | medium | 5.4 | 1% |
| CVE-2021-25046 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose pa | medium | 5.4 | 1% |
| CVE-2024-0378 | ai-engine (WordPress plugin) | The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the A | medium | 6.5 | 1% |
| CVE-2024-10877 | advanced-form-integration (WordPress plugin) | The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_ar | medium | 6.1 | 1% |
| CVE-2024-1383 | wpvivid-backup-mainwp (WordPress plugin) | The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up | medium | 6.1 | 1% |
| CVE-2019-7168 | croogo/croogo | Croogo vulnerable to XSS in Blog field | medium | 4.8 | 1% |
| CVE-2019-7169 | croogo/croogo | Croogo vulnerable to XSS in title field | medium | 4.8 | 1% |
| CVE-2019-7170 | croogo/croogo | Croogo vulnerable to XSS in title field | medium | 4.8 | 1% |
| CVE-2019-7171 | croogo/croogo | Croogo vulnerable to XSS in title field | medium | 4.8 | 1% |
| CVE-2019-7173 | croogo/croogo | Croogo vulnerable to Cross-site Scripting in title field | medium | 4.8 | 1% |
| CVE-2021-36829 | launcher (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0 | medium | 4.8 | 1% |
| CVE-2021-36847 | webba-booking-lite (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-2152 | duplicate-page-and-post (WordPress plugin) | The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2022-2384 | digital-publications-by-supsystic (WordPress plugin) | The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users | medium | 4.8 | 1% |
| CVE-2023-36236 | bagisto/bagisto | Cross-site Scripting in Bagisto | medium | 4.8 | 1% |
| CVE-2023-6884 | widget-google-reviews (WordPress plugin) | This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 | medium | 6.4 | 1% |