Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24269 | sina-extension-for-elementor (WordPress plugin) | The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2021-24270 | dethemekit-for-elementor (WordPress plugin) | The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lowe | medium | 5.4 | 1% |
| CVE-2021-24271 | ultimate-addons-for-elementor (WordPress plugin) | The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (X | medium | 5.4 | 1% |
| CVE-2021-24273 | clever-addons-for-elementor (WordPress plugin) | The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2021-24539 | coming-soon\,-under-construction-\&-maintenance-mode-by-dazzler (WordPress plugin) | The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description | medium | 4.8 | 1% |
| CVE-2024-12873 | custom-field-manager (WordPress plugin) | The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leadin | medium | 6.1 | 1% |
| CVE-2010-10008 | simplesamlphp/simplesamlphp-module-openidprovider | simplesamlphp-module-openidprovider Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-43828 | intelliants/subrion | Subrion CMS Cross-site Scripting vulnerability in /panel/languages | medium | 5.4 | 1% |
| CVE-2023-43830 | intelliants/subrion | Subrion CMS XSS in /panel/configuration/financial/ | medium | 5.4 | 1% |
| CVE-2020-23700 | lavalite/cms | Cross-site scripting in LavaLite-CMS | medium | 4.8 | 1% |
| CVE-2023-0312 | thorsten/phpmyfaq | thorsten/phpmyfaq is vulnerable to cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2021-36863 | quiz-master-next (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress. | medium | 5.4 | 1% |
| CVE-2022-33943 | bxslider-wp (WordPress plugin) | Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at W | medium | 5.4 | 1% |
| CVE-2021-25056 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perf | medium | 4.8 | 1% |
| CVE-2021-25066 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users t | medium | 4.8 | 1% |
| CVE-2021-25088 | google-xml-sitemaps (WordPress plugin) | The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could a | medium | 4.8 | 1% |
| CVE-2022-0663 | print\,-pdf\,-email-by-printfriendly (WordPress plugin) | The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which cou | medium | 4.8 | 1% |
| CVE-2022-1266 | post-grid\,-slider-\&-carousel-ultimate (WordPress plugin) | The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow hig | medium | 4.8 | 1% |
| CVE-2022-1301 | wp-contact-slider (WordPress plugin) | The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow | medium | 4.8 | 1% |
| CVE-2022-1326 | form---contact-form (WordPress plugin) | The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged us | medium | 4.8 | 1% |
| CVE-2022-1327 | image-gallery (WordPress plugin) | The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged use | medium | 4.8 | 1% |
| CVE-2022-1335 | slideshow-ck (WordPress plugin) | The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users s | medium | 4.8 | 1% |
| CVE-2022-1336 | carousel-ck (WordPress plugin) | The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users su | medium | 4.8 | 1% |
| CVE-2022-1710 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allo | medium | 4.8 | 1% |
| CVE-2022-1717 | custom-share-buttons-with-floating-sidebar (WordPress plugin) | The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could al | medium | 4.8 | 1% |
| CVE-2022-1814 | wp-admin-style (WordPress plugin) | The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-1889 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-1894 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2022-1896 | underconstruction (WordPress plugin) | The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting befor | medium | 4.8 | 1% |
| CVE-2022-1915 | wp-zillow-review-slider (WordPress plugin) | The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross- | medium | 4.8 | 1% |
| CVE-2022-1971 | nextcellent-gallery (WordPress plugin) | The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high priv | medium | 4.8 | 1% |
| CVE-2022-1994 | login-with-otp-over-sms\,-email\,-whatsapp-and-google-authenticator (WordPress plugin) | The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing h | medium | 4.8 | 1% |
| CVE-2022-2050 | wp-paginate (WordPress plugin) | The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored | medium | 4.8 | 1% |
| CVE-2022-2093 | wp-duplicate-page (WordPress plugin) | The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-2100 | page-generator (WordPress plugin) | The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to p | medium | 4.8 | 1% |
| CVE-2022-2118 | 404s (WordPress plugin) | The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross | medium | 4.8 | 1% |
| CVE-2022-2148 | linkedin-company-updates (WordPress plugin) | The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-2149 | very-simple-breadcrumb (WordPress plugin) | The Very Simple Breadcrumb WordPress plugin through 1.0 does not sanitise and escape its settings, allowing high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2022-2151 | best-contact-management-software (WordPress plugin) | The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users | medium | 4.8 | 1% |
| CVE-2022-2169 | loading-page-with-loading-screen (WordPress plugin) | The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admi | medium | 4.8 | 1% |
| CVE-2022-2186 | simple-post-notes (WordPress plugin) | The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin t | medium | 4.8 | 1% |
| CVE-2022-2194 | accept-stripe (WordPress plugin) | The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users s | medium | 4.8 | 1% |
| CVE-2022-3420 | official-integration-for-billingo (WordPress plugin) | The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow hig | medium | 4.8 | 1% |
| CVE-2024-13543 | zarinpal-paid-download (WordPress plugin) | The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2024-13570 | stray-random-quotes (WordPress plugin) | The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leadi | medium | 6.1 | 1% |
| CVE-2022-1321 | google-authenticator (WordPress plugin) | The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious | medium | 4.8 | 1% |
| CVE-2023-48649 | concrete5/concrete5 | Concrete CMS Cross-site Scripting vulnerability | low | 3.5 | 1% |
| CVE-2023-5335 | buzzsprout-podcasting (WordPress plugin) | The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, an | medium | 6.4 | 1% |
| CVE-2023-5666 | accordions-wp (WordPress plugin) | The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcpaccordion' shortcode in all versions up | medium | 6.4 | 1% |
| CVE-2022-35882 | gs-testimonial (WordPress plugin) | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9 | medium | 4.8 | 1% |