Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3462 | highlight-focus (WordPress plugin) | The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2023-4423 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | medium | 4.4 | 1% |
| CVE-2024-13347 | essential-wp-real-estate (WordPress plugin) | The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to | medium | 6.8 | 1% |
| CVE-2017-20158 | vova07/yii2-fileapi-widget | Yii2 FileAPI Widget vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2017-1000227 | salutation (WordPress plugin) | Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin c | medium | 5.4 | 1% |
| CVE-2018-5214 | add-link-to-facebook (WordPress plugin) | The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php. | medium | 5.4 | 1% |
| CVE-2018-5311 | easy-custom-auto-excerpt (WordPress plugin) | The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php? | medium | 5.4 | 1% |
| CVE-2018-5312 | tabs-responsive (WordPress plugin) | The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php. | medium | 5.4 | 1% |
| CVE-2020-20129 | wanglelecc/laracms | Cross-site Scripting in LaraCMS | medium | 5.4 | 1% |
| CVE-2020-23049 | forkcms/forkcms | Cross-site scripting in forkcms | medium | 5.4 | 1% |
| CVE-2020-28957 | froxlor/froxlor | Foxlor cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2022-1549 | wp-athletics (WordPress plugin) | The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the val | medium | 5.4 | 1% |
| CVE-2022-1776 | popups\,-welcome-bar\,-optins-and-lead-generation-plugin (WordPress plugin) | The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign paramete | medium | 5.4 | 1% |
| CVE-2022-1964 | easy-svg-support (WordPress plugin) | The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Autho | medium | 5.4 | 1% |
| CVE-2023-44766 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-3675 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flip Carousel, F | medium | 6.4 | 1% |
| CVE-2023-3708 | amela (WordPress plugin), arendelle (WordPress plugin), everse (WordPress plugin) +2 more | Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insuff | medium | 6.1 | 1% |
| CVE-2024-13112 | wp-mediatagger (WordPress plugin) | The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 1% |
| CVE-2024-13221 | fantastic-elasticsearch (WordPress plugin) | The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, l | medium | 6.1 | 1% |
| CVE-2024-13224 | slidedeck-1-lite-content-slider (WordPress plugin) | The SlideDeck 1 Lite Content Slider WordPress plugin through 1.4.8 does not sanitise and escape a parameter before outputting it back in the | medium | 6.1 | 1% |
| CVE-2024-13225 | ect-home-page-products (WordPress plugin) | The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2024-13226 | a5-custom-login-page (WordPress plugin) | The A5 Custom Login Page WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2024-9944 | woocommerce (WordPress plugin) | The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin | medium | 5.3 | 1% |
| CVE-2013-10020 | a-forms (WordPress plugin) | A vulnerability, which was classified as problematic, was found in MMDeveloper A Forms Plugin up to 1.4.2 on WordPress. This affects an unkn | low | 3.5 | 1% |
| CVE-2014-125090 | media-downloader (WordPress plugin) | A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects t | low | 3.5 | 1% |
| CVE-2015-10107 | simplr-registration-form-plus\+ (WordPress plugin) | A vulnerability was found in Simplr Registration Form Plus+ Plugin up to 2.3.4 on WordPress and classified as problematic. This issue affect | low | 3.5 | 1% |
| CVE-2015-10119 | view-all-post\'s-pages (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affe | low | 3.5 | 1% |
| CVE-2023-4961 | poptin (WordPress plugin) | The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1 | medium | 6.4 | 1% |
| CVE-2021-3904 | getgrav/grav | Cross-Site Scripting in grav | medium | 6.3 | 1% |
| CVE-2023-27237 | lavalite/cms | LavaLite CMS vulnerable to host header injection attack | medium | 6.1 | 1% |
| CVE-2024-0976 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-S | medium | 6.1 | 1% |
| CVE-2021-32475 | moodle/moodle | Moodle stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2024-1038 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via a 'playground | medium | 5.4 | 1% |
| CVE-2024-0386 | weforms (WordPress plugin) | The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' HTTP header in all versions up to, and inclu | high | 7.2 | 1% |
| CVE-2021-41169 | sulu/sulu | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu | medium | 6.2 | 1% |
| CVE-2021-4244 | yikesinc/yikes-inc-easy-mailchimp-extender | yikes-inc-easy-mailchimp-extender Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-4524 | roots/soil | Roots Soil plugin vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2019-8157 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Scripting via admin panel | medium | 5.4 | 1% |
| CVE-2023-44770 | tribalsystems/zenario | Zenario CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2019-8152 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2022-1945 | coming-soon-\&-maintenance-mode (WordPress plugin) | The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high priv | medium | 4.8 | 1% |
| CVE-2022-2114 | data-tables-generator (WordPress plugin) | The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could | medium | 4.8 | 1% |
| CVE-2021-24255 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2021-24256 | elementor---header\,-footer-\&-blocks-template (WordPress plugin) | The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Sc | medium | 5.4 | 1% |
| CVE-2021-24257 | premium-addons-for-elementor (WordPress plugin) | The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS | medium | 5.4 | 1% |
| CVE-2021-24259 | elementor-addon-elements (WordPress plugin) | The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) b | medium | 5.4 | 1% |
| CVE-2021-24262 | woolentor---woocommerce-elementor-addons-\+-builder (WordPress plugin) | The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site | medium | 5.4 | 1% |
| CVE-2021-24264 | image-hover-effects (WordPress plugin) | The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2021-24266 | the-plus-addons-for-elementor-page-builder-lite (WordPress plugin) | The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Sit | medium | 5.4 | 1% |
| CVE-2021-24268 | jetwidgets-for-elementor (WordPress plugin) | The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by | medium | 5.4 | 1% |