Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.1, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-15601 | elefant/cms | Elefant CMS Improper Input Validation | critical | 9.8 | 2% |
| CVE-2019-14773 | insert-php (WordPress plugin) | admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action | high | 7.5 | 2% |
| CVE-2018-14504 | mantisbt/mantisbt | MantisBT allows XSS on the Edit Filter page via crafted filter name | medium | 6.1 | 2% |
| CVE-2021-24214 | openid-connect-generic-client (WordPress plugin) | The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, lead | medium | 6.1 | 2% |
| CVE-2020-24403 | magento/community-edition, magento/project-community-edition | Magento incorrect user permissions vulnerability within the Inventory component | low | 2.7 | 2% |
| CVE-2020-14201 | dolibarr/dolibarr | Dolibarr CRM allows Privilege Escalation | medium | 6.5 | 2% |
| CVE-2011-5307 | photosmash (WordPress plugin) | Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitra | medium | 4.3 | 2% |
| CVE-2014-4516 | bic-media-widget (WordPress plugin) | Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows re | medium | 4.3 | 2% |
| CVE-2014-4517 | cbi-referral-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows re | medium | 4.3 | 2% |
| CVE-2014-4518 | contactme (WordPress plugin) | Cross-site scripting (XSS) vulnerability in xd_resize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows r | medium | 4.3 | 2% |
| CVE-2014-4522 | dssearchagent (WordPress plugin) | Cross-site scripting (XSS) vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for Word | medium | 4.3 | 2% |
| CVE-2014-4526 | efence (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress allow remote attack | medium | 4.3 | 2% |
| CVE-2014-4528 | fbpromotions (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromo | medium | 4.3 | 2% |
| CVE-2014-4531 | game-tabs (WordPress plugin) | Cross-site scripting (XSS) vulnerability in main_page.php in the Game tabs plugin 0.4.0 and earlier for WordPress allows remote attackers to | medium | 4.3 | 2% |
| CVE-2014-4533 | geo-redirector (WordPress plugin) | Cross-site scripting (XSS) vulnerability in ajax_functions.php in the GEO Redirector plugin 1.0.1 and earlier for WordPress allows remote at | medium | 4.3 | 2% |
| CVE-2014-4537 | keyword-strategy-internal-links (WordPress plugin) | Cross-site scripting (XSS) vulnerability in inpage.tpl.php in the Keyword Strategy Internal Links plugin 2.0 and earlier for WordPress allow | medium | 4.3 | 2% |
| CVE-2014-4538 | malware-finder (WordPress plugin) | Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers t | medium | 4.3 | 2% |
| CVE-2014-4540 | oleggo-livestream (WordPress plugin) | Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for Word | medium | 4.3 | 2% |
| CVE-2014-4541 | omfg-mobile (WordPress plugin) | Cross-site scripting (XSS) vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earl | medium | 4.3 | 2% |
| CVE-2014-4542 | ooorl (WordPress plugin) | Cross-site scripting (XSS) vulnerability in redirect.php in the Ooorl plugin for WordPress allows remote attackers to inject arbitrary web s | medium | 4.3 | 2% |
| CVE-2014-4546 | rezgo (WordPress plugin) | Cross-site scripting (XSS) vulnerability in book_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inj | medium | 4.3 | 2% |
| CVE-2014-4551 | social-connect (WordPress plugin) | Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and earlier for WordPress allows remote | medium | 4.3 | 2% |
| CVE-2014-4552 | spotlightyour (WordPress plugin) | Cross-site scripting (XSS) vulnerability in library/includes/payment/paypalexpress/DoDirectPayment.php in the Spotlight (spotlightyour) plug | medium | 4.3 | 2% |
| CVE-2014-4555 | style-it (WordPress plugin) | Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers | medium | 4.3 | 2% |
| CVE-2014-4556 | swipe-checkout-for-eshop (WordPress plugin) | Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows re | medium | 4.3 | 2% |
| CVE-2014-4557 | swipe-hq-checkout-for-jigoshop (WordPress plugin) | Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) plugin 3.1.0 | medium | 4.3 | 2% |
| CVE-2014-4560 | toolpage (WordPress plugin) | Cross-site scripting (XSS) vulnerability in includes/getTipo.php in the ToolPage plugin 1.6.1 and earlier for WordPress allows remote attack | medium | 4.3 | 2% |
| CVE-2014-4563 | url-cloak-\&-encrypt (WordPress plugin) | Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allow | medium | 4.3 | 2% |
| CVE-2014-4564 | validated-plugin (WordPress plugin) | Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inj | medium | 4.3 | 2% |
| CVE-2014-4565 | verification-code-for-comments (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPre | medium | 4.3 | 2% |
| CVE-2014-4566 | verweise-wordpress-twitter (WordPress plugin) | Cross-site scripting (XSS) vulnerability in res/fake_twitter/frame.php in the "verwei.se - WordPress - Twitter" (verweise-wordpress-twitter) | medium | 4.3 | 2% |
| CVE-2014-4572 | votecount-for-balatarin (WordPress plugin) | Cross-site scripting (XSS) vulnerability in bvc.php in the Votecount for Balatarin plugin 0.1.1 and earlier for WordPress allows remote atta | medium | 4.3 | 2% |
| CVE-2014-4573 | walk-score (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in frame-maker.php in the Walk Score plugin 0.5.5 and earlier for WordPress allow remote | medium | 4.3 | 2% |
| CVE-2014-4575 | wikipop (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inj | medium | 4.3 | 2% |
| CVE-2014-4576 | wordpress-social-login (WordPress plugin) | Cross-site scripting (XSS) vulnerability in services/diagnostics.php in the WordPress Social Login plugin 2.0.3 and earlier for WordPress al | medium | 4.3 | 2% |
| CVE-2014-4578 | wp-app-maker (WordPress plugin) | Cross-site scripting (XSS) vulnerability in asset-studio/icons-launcher.php in the WP App Maker plugin 1.0.16.4 and earlier for WordPress al | medium | 4.3 | 2% |
| CVE-2014-4579 | wp-appointments-schedules (WordPress plugin) | Cross-site scripting (XSS) vulnerability in js/test.php in the Appointments Scheduler plugin 1.5 and earlier for WordPress allows remote att | medium | 4.3 | 2% |
| CVE-2014-4580 | wp-blipbot (WordPress plugin) | Cross-site scripting (XSS) vulnerability in blipbot.ajax.php in the WP BlipBot plugin 3.0.9 and earlier for WordPress allows remote attacker | medium | 4.3 | 2% |
| CVE-2014-4581 | wpcb (WordPress plugin) | Cross-site scripting (XSS) vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4582 | wp-consultant (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/admin_show_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows re | medium | 4.3 | 2% |
| CVE-2014-4583 | wp-contact-sidebar-widget (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earli | medium | 4.3 | 2% |
| CVE-2014-4584 | wp-easybooking (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/editFacility.php in the wp-easybooking plugin 1.0.3 and earlier for WordPress allows remot | medium | 4.3 | 2% |
| CVE-2014-4585 | wp-facethumb (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WP-FaceThumb plugin possibly 1.0 and earlier for WordPress allows remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4590 | wp-microblogs (WordPress plugin) | Cross-site scripting (XSS) vulnerability in get.php in the WP Microblogs plugin 0.4.0 and earlier for WordPress allows remote attackers to i | medium | 4.3 | 2% |
| CVE-2014-4591 | wp-picasa-image (WordPress plugin) | Cross-site scripting (XSS) vulnerability in picasa_upload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote atta | medium | 4.3 | 2% |
| CVE-2014-4593 | wp-plugin-manager (WordPress plugin) | Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPres | medium | 4.3 | 2% |
| CVE-2014-4595 | wp-restful (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject | medium | 4.3 | 2% |
| CVE-2014-4599 | wp-business-directory (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier | medium | 4.3 | 2% |
| CVE-2014-4601 | wu-rating (WordPress plugin) | Cross-site scripting (XSS) vulnerability in wu-ratepost.php in the Wu-Rating plugin 1.0 12319 and earlier for WordPress allows remote attack | medium | 4.3 | 2% |
| CVE-2014-4602 | xen-carousel (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in xencarousel-admin.js.php in the XEN Carousel plugin 0.12.2 and earlier for WordPress | medium | 4.3 | 2% |