Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3220 | advanced-comment-form (WordPress plugin) | The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2024-12737 | wp-base-booking-of-appointments\,-services-and-events (WordPress plugin) | The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outpu | medium | 6.1 | 1% |
| CVE-2024-13630 | newsticker (WordPress plugin) | The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | medium | 6.1 | 1% |
| CVE-2023-0786 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 4.8 | 1% |
| CVE-2023-1754 | thorsten/phpmyfaq | phpMyFAQ vulnerable to improper input validation | medium | 4.7 | 1% |
| CVE-2022-37407 | photoblocks-grid-gallery (WordPress plugin) | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. | medium | 4.1 | 1% |
| CVE-2021-24933 | dynamic-widgets (WordPress plugin) | The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when usin | medium | 5.4 | 1% |
| CVE-2021-24958 | meks-easy-photo-feed-widget (WordPress plugin) | The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_ac | medium | 5.4 | 1% |
| CVE-2021-24971 | wp-responsive-menu (WordPress plugin) | The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well | medium | 5.4 | 1% |
| CVE-2021-25057 | translation-exchange (WordPress plugin) | The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Projec | medium | 5.4 | 1% |
| CVE-2021-25058 | the-buffer-button (WordPress plugin) | The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username | medium | 5.4 | 1% |
| CVE-2021-25060 | five-star-business-profile-and-schema (WordPress plugin) | The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_co | medium | 5.4 | 1% |
| CVE-2021-25090 | portfolio-gallery\,-product-catalog---grid-kit-portfolio (WordPress plugin) | The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions relate | medium | 5.4 | 1% |
| CVE-2021-25106 | wplegalpages (WordPress plugin) | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for | medium | 5.4 | 1% |
| CVE-2022-0200 | portfolio-post (WordPress plugin) | Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the r | medium | 5.4 | 1% |
| CVE-2022-0397 | wpc-smart-wishlist-for-woocommerce (WordPress plugin) | The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it bac | medium | 5.4 | 1% |
| CVE-2022-0423 | 3d-flipbook (WordPress plugin) | The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any | medium | 5.4 | 1% |
| CVE-2022-1152 | menubar (WordPress plugin) | The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the | medium | 5.4 | 1% |
| CVE-2022-1393 | wp-subtitle (WordPress plugin) | The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle i | medium | 5.4 | 1% |
| CVE-2022-3137 | taskbuilder (WordPress plugin) | The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (s | medium | 5.4 | 1% |
| CVE-2024-13918 | laravel/framework | Laravel framework susceptible to reflected cross-site scripting | medium | 4.7 | 1% |
| CVE-2023-4919 | iframe (WordPress plugin) | The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `iframe` shortcode in versions up to, and including, 4. | medium | 6.4 | 1% |
| CVE-2023-5362 | spice-post-slider (WordPress plugin) | The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' | medium | 6.4 | 1% |
| CVE-2023-5669 | featured-image-caption (WordPress plugin) | The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all | medium | 6.4 | 1% |
| CVE-2022-36791 | torro-forms (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress. | medium | 5.4 | 1% |
| CVE-2023-2836 | crm-perks-forms (WordPress plugin) | The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1. | medium | 4.4 | 1% |
| CVE-2021-32668 | typo3/cms, typo3/cms-core | Cross-Site Scripting in Query Generator & Query View | medium | 6.4 | 1% |
| CVE-2022-4410 | permalink-manager (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due t | medium | 6.4 | 1% |
| CVE-2024-1408 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 1% |
| CVE-2022-2280 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2017-8780 | genix/cms | GeniXCMS Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2021-24707 | nd-learning (WordPress plugin) | The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high | medium | 4.8 | 1% |
| CVE-2021-24810 | wp-event-manager (WordPress plugin) | The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high pr | medium | 4.8 | 1% |
| CVE-2021-24895 | cybersoldier (WordPress plugin) | The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an attribute, which cou | medium | 4.8 | 1% |
| CVE-2021-24898 | editable-table (WordPress plugin) | The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high pri | medium | 4.8 | 1% |
| CVE-2021-24903 | grand-flagallery (WordPress plugin) | The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privil | medium | 4.8 | 1% |
| CVE-2021-24944 | absolutely-glamorous-custom-admin (WordPress plugin) | The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2021-24995 | html5-responsive-faq (WordPress plugin) | The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high | medium | 4.8 | 1% |
| CVE-2021-25029 | learning-management-system (WordPress plugin) | The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privi | medium | 4.8 | 1% |
| CVE-2021-25101 | anti-malware-security-and-brute-force-firewall (WordPress plugin) | The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputt | medium | 4.8 | 1% |
| CVE-2021-25105 | ivory-search (WordPress plugin) | The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform | medium | 4.8 | 1% |
| CVE-2022-0211 | shield-security (WordPress plugin) | The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2022-0376 | user-meta-user-profile-builder-and-user-management (WordPress plugin) | The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting the | medium | 4.8 | 1% |
| CVE-2022-0388 | interactive-medical-drawing-of-human-body (WordPress plugin) | The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privile | medium | 4.8 | 1% |
| CVE-2022-0389 | wp-time-slots-booking-form (WordPress plugin) | The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to | medium | 4.8 | 1% |
| CVE-2022-0418 | event-list (WordPress plugin) | The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2022-0590 | bulletproof-security (WordPress plugin) | The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2022-0649 | adrotate (WordPress plugin) | The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Script | medium | 4.8 | 1% |
| CVE-2022-0659 | sync-qcloud-cos (WordPress plugin) | The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perfo | medium | 4.8 | 1% |
| CVE-2022-0662 | adrotate (WordPress plugin) | The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cros | medium | 4.8 | 1% |