Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0701 | seo-301-meta (WordPress plugin) | The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-0728 | easy-smooth-scroll-links (WordPress plugin) | The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2022-0840 | easy-social-icons (WordPress plugin) | The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing hi | medium | 4.8 | 1% |
| CVE-2022-0874 | wp-social-buttons (WordPress plugin) | The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to | medium | 4.8 | 1% |
| CVE-2022-0876 | social-comments (WordPress plugin) | The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such | medium | 4.8 | 1% |
| CVE-2022-1027 | page-restriction (WordPress plugin) | The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to in | medium | 4.8 | 1% |
| CVE-2022-1046 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high priv | medium | 4.8 | 1% |
| CVE-2022-1062 | th23-social (WordPress plugin) | The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2022-1063 | thank-me-later (WordPress plugin) | The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Message | medium | 4.8 | 1% |
| CVE-2022-1088 | page-security-\&-membership (WordPress plugin) | The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 1% |
| CVE-2022-1089 | bulk-edit-and-create-user-profiles---wp-sheet-editor (WordPress plugin) | The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high p | medium | 4.8 | 1% |
| CVE-2022-1090 | good-bad-comments (WordPress plugin) | The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2022-1156 | books-\&-papers (WordPress plugin) | The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2022-1228 | opeansea (WordPress plugin) | The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could a | medium | 4.8 | 1% |
| CVE-2022-1265 | bulletproof-security (WordPress plugin) | The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which could allow high-privi | medium | 4.8 | 1% |
| CVE-2022-1275 | bannerman (WordPress plugin) | The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged users to perform Cr | medium | 4.8 | 1% |
| CVE-2022-1294 | imdb-info-box (WordPress plugin) | The IMDB info box WordPress plugin through 2.0 does not sanitize and escape some of its settings, which could allow high-privileged users to | medium | 4.8 | 1% |
| CVE-2022-1298 | tabs-responsive (WordPress plugin) | The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as | medium | 4.8 | 1% |
| CVE-2022-1299 | slideshow (WordPress plugin) | The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-pri | medium | 4.8 | 1% |
| CVE-2022-1303 | slide-anything (WordPress plugin) | The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-1338 | easily-generate-rest-api (WordPress plugin) | The Easily Generate Rest API Url WordPress plugin through 1.0.0 does not escape some of its settings, allowing high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-1387 | no-future-posts (WordPress plugin) | The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perfo | medium | 4.8 | 1% |
| CVE-2022-1395 | easy-faq-with-expanding-text (WordPress plugin) | The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users | medium | 4.8 | 1% |
| CVE-2022-1408 | hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attribute | medium | 4.8 | 1% |
| CVE-2022-1435 | track-\&-trace (WordPress plugin) | The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-1456 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admi | medium | 4.8 | 1% |
| CVE-2022-1469 | fibosearch (WordPress plugin) | The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-1541 | video-slider (WordPress plugin) | The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged use | medium | 4.8 | 1% |
| CVE-2022-1542 | hpb-dashboard (WordPress plugin) | The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2022-1568 | team-members (WordPress plugin) | The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2022-1569 | drag-\&-drop-builder (WordPress plugin) | The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before | medium | 4.8 | 1% |
| CVE-2022-1643 | birthdays-widget (WordPress plugin) | The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-1644 | call\&book-mobile-bar (WordPress plugin) | The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-1645 | amazon-link (WordPress plugin) | The Amazon Link WordPress plugin through 3.2.10 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 1% |
| CVE-2022-1646 | simple-real-estate-pack (WordPress plugin) | The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 1% |
| CVE-2022-1647 | formcraft (WordPress plugin) | The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perfor | medium | 4.8 | 1% |
| CVE-2022-23987 | ws-form (WordPress plugin) | The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2025-61417 | tastyigniter/tastyigniter | TastyIgniter vulnerable to Cross-Site Scripting | low | 0.0 | 1% |
| CVE-2022-36573 | pagekit/pagekit | Pagekit CMS cross-site scripting in Markdown text box where articles are edited | medium | 6.1 | 1% |
| CVE-2023-44765 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-2575 | wbw-currency-switcher-for-woocommerce (WordPress plugin) | The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow | medium | 4.8 | 1% |
| CVE-2022-2823 | slider\,-gallery\,-and-carousel (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parame | medium | 4.8 | 1% |
| CVE-2022-3069 | wordlift (WordPress plugin) | The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perfor | medium | 4.8 | 1% |
| CVE-2022-3207 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2022-40195 | address-email-and-phone-validation (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-40672 | cpo-shortcodes (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress. | medium | 4.8 | 1% |
| CVE-2023-2082 | buymeacoffee (WordPress plugin) | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including | medium | 6.4 | 1% |
| CVE-2023-2404 | crm-customer-relationship-management-by-vcita (WordPress plugin) | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions | medium | 6.4 | 1% |
| CVE-2017-20057 | elefant/cms | Cross site scripting in Elefant CMS | medium | 6.1 | 1% |
| CVE-2024-6704 | wpdiscuz (WordPress plugin) | The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a | medium | 5.3 | 1% |