Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-30110 | mojo42/jirafeau | Cross-site Scripting in Jirafeau | medium | 6.1 | 1% |
| CVE-2023-43647 | baserproject/basercms | baserCMS Cross-site Scripting vulnerability in File upload Feature | medium | 6.1 | 1% |
| CVE-2022-21149 | s-cart/core, s-cart/s-cart | SCart is vulnerable to cross-site scripting (XSS) | medium | 5.4 | 1% |
| CVE-2023-5452 | snipe/snipe-it | Cross-site Scripting in snipe/snipe-it | medium | 5.4 | 1% |
| CVE-2022-43688 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2023-2591 | nilsteampassnet/teampass | teampass vulnerable to code injection | high | 7.1 | 1% |
| CVE-2022-0612 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 6.7 | 1% |
| CVE-2023-2710 | wp-responsive-video-gallery-with-lightbox (WordPress plugin) | The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter i | medium | 6.1 | 1% |
| CVE-2018-11580 | mass-pagesposts-creator (WordPress plugin) | An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in | medium | 5.4 | 1% |
| CVE-2018-16342 | showdoc/showdoc | Showdoc XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2018-20758 | modx/revolution | MODX vulnerability allows for XSS via user settings parameters | medium | 5.4 | 1% |
| CVE-2021-24965 | five-star-restaurant-reservations (WordPress plugin) | The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule | medium | 5.4 | 1% |
| CVE-2021-24974 | product-feed-pro-for-woocommerce (WordPress plugin) | The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, | medium | 5.4 | 1% |
| CVE-2022-0502 | remdex/livehelperchat | Cross-site Scripting in LiveHelperChat | medium | 5.4 | 1% |
| CVE-2021-36857 | testimonial-builder (WordPress plugin) | Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress. | medium | 4.8 | 1% |
| CVE-2015-10095 | woo-popup (WordPress plugin) | A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress. This affects an unknown part of the f | low | 3.5 | 1% |
| CVE-2015-10117 | gf-windcave-free (WordPress plugin) | A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an u | low | 3.5 | 1% |
| CVE-2024-55227 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2025-54264 | magento/community-edition, magento/project-community-edition | Magento vulnerable to stored Cross-Site Scripting (XSS) | high | 8.1 | 1% |
| CVE-2023-3087 | fluent-smtp (WordPress plugin) | The FluentSMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.2. | high | 7.2 | 1% |
| CVE-2023-3158 | mail-control (WordPress plugin) | The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 0. | high | 7.2 | 1% |
| CVE-2024-0591 | wpdatatables (WordPress plugin) | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scr | medium | 6.1 | 1% |
| CVE-2021-25005 | seur-oficial (WordPress plugin) | The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cr | medium | 4.8 | 1% |
| CVE-2021-42360 | starter-templates (WordPress plugin) | On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which include | high | 7.6 | 1% |
| CVE-2021-27912 | mautic/core | XSS vulnerability on asset view | high | 7.1 | 1% |
| CVE-2023-2120 | wp-responsive-thumbnail-slider (WordPress plugin) | The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions | medium | 6.1 | 1% |
| CVE-2024-2738 | permalink-manager (WordPress plugin) | The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple | medium | 6.1 | 1% |
| CVE-2025-5084 | ajax-filter-posts (WordPress plugin) | The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray['read_more_text']’ parameter in | medium | 6.1 | 1% |
| CVE-2021-24821 | cost-calculator (WordPress plugin) | The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attack | medium | 5.4 | 1% |
| CVE-2021-24826 | custom-content-shortcode (WordPress plugin) | The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contribut | medium | 5.4 | 1% |
| CVE-2021-24880 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users wit | medium | 5.4 | 1% |
| CVE-2021-24897 | add-subtitle (WordPress plugin) | The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when ou | medium | 5.4 | 1% |
| CVE-2021-25113 | dropdown-menu-widget (WordPress plugin) | The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low p | medium | 5.4 | 1% |
| CVE-2022-0186 | image-photo-gallery-final-tiles-grid (WordPress plugin) | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gal | medium | 5.4 | 1% |
| CVE-2022-0205 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as autho | medium | 5.4 | 1% |
| CVE-2022-0898 | igniteup (WordPress plugin) | The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_htm | medium | 5.4 | 1% |
| CVE-2022-1506 | wp-born-babies (WordPress plugin) | The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low | medium | 5.4 | 1% |
| CVE-2022-1562 | enable-svg (WordPress plugin) | The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to u | medium | 5.4 | 1% |
| CVE-2022-3074 | slider-hero (WordPress plugin) | The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site | medium | 4.8 | 1% |
| CVE-2021-32667 | typo3/cms, typo3/cms-core | Cross-Site Scripting in Page Preview | medium | 6.4 | 1% |
| CVE-2021-32669 | typo3/cms, typo3/cms-core | Cross-Site Scripting in Backend Grid View | medium | 6.4 | 1% |
| CVE-2023-2298 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b | high | 7.2 | 1% |
| CVE-2024-0826 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to | medium | 6.4 | 1% |
| CVE-2024-2081 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the foogallery_attachme | medium | 6.4 | 1% |
| CVE-2024-4036 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in all versions up to, and incl | medium | 6.4 | 1% |
| CVE-2024-4156 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 1% |
| CVE-2022-30429 | neos/neos | Neos CMS vulnerable to XSS in various backend modules | medium | 5.4 | 1% |
| CVE-2023-5544 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-0209 | facebook-wall-and-social-integration (WordPress plugin) | The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, whi | medium | 4.8 | 1% |
| CVE-2022-3136 | social-rocket (WordPress plugin) | The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 1% |