Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-36378 | floating-div (WordPress plugin) | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at | medium | 4.8 | 1% |
| CVE-2024-34355 | typo3/cms-core | TYPO3 vulnerable to an HTML Injection in the History Module | low | 3.5 | 1% |
| CVE-2014-125103 | twitter (WordPress plugin) | A vulnerability was found in BestWebSoft Twitter Plugin up to 1.3.2 on WordPress. It has been declared as problematic. Affected by this vuln | low | 2.4 | 1% |
| CVE-2023-5703 | gift-up (WordPress plugin) | The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gif | medium | 6.4 | 1% |
| CVE-2022-48150 | shopware/shopware | Shopware vulnerable to cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2021-36870 | wp-google-maps (WordPress plugin) | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulner | medium | 5.5 | 1% |
| CVE-2021-36872 | wordpress-popular-posts (WordPress plugin) | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widg | medium | 5.5 | 1% |
| CVE-2022-4519 | wp-user (WordPress plugin) | The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, | medium | 5.5 | 1% |
| CVE-2022-37421 | silverstripe/cms | Silverstipe CMS Stored XSS in custom meta tags | medium | 5.4 | 1% |
| CVE-2022-38146 | silverstripe/admin | URL XSS vulnerability due to outdated jquery in CMS | medium | 5.4 | 1% |
| CVE-2022-1028 | wordpress-security (WordPress plugin) | The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its setti | medium | 4.8 | 1% |
| CVE-2022-1995 | malware-scanner (WordPress plugin) | The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with adminis | medium | 4.8 | 1% |
| CVE-2024-13114 | wp-projects-portfolio-with-client-testimonials (WordPress plugin) | The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting i | medium | 6.1 | 1% |
| CVE-2024-13222 | user-messages (WordPress plugin) | The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 1% |
| CVE-2024-13325 | glossy (WordPress plugin) | The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | medium | 6.1 | 1% |
| CVE-2024-13326 | ibuildapp (WordPress plugin) | The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2024-13327 | musicbox (WordPress plugin) | The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | medium | 6.1 | 1% |
| CVE-2024-13328 | giga-messenger (WordPress plugin) | The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 1% |
| CVE-2024-13492 | guten-free-options (WordPress plugin) | The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leadin | medium | 6.1 | 1% |
| CVE-2024-0904 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privileg | medium | 5.9 | 1% |
| CVE-2023-28477 | concrete5/concrete5 | Stored cross site scripting on API integration | medium | 5.5 | 1% |
| CVE-2020-13971 | shopware/platform | Shopware vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-44764 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-3561 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 6.1 | 1% |
| CVE-2025-1303 | plugin-oficial (WordPress plugin) | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 1% |
| CVE-2022-4619 | codelights-shortcodes-and-widgets (WordPress plugin) | The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in v | medium | 5.5 | 1% |
| CVE-2022-27854 | wp-testing (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possib | medium | 5.4 | 1% |
| CVE-2021-41836 | fathom-analytics (WordPress plugin) | The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the | medium | 4.8 | 1% |
| CVE-2022-3469 | wp-attachments (WordPress plugin) | The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users | medium | 4.8 | 1% |
| CVE-2015-10101 | google-analytics-top-content-widget (WordPress plugin) | A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this | low | 3.5 | 1% |
| CVE-2021-36889 | tarteaucitronjs (WordPress plugin) | Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR Wo | low | 3.4 | 1% |
| CVE-2023-5320 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | critical | 9.0 | 1% |
| CVE-2024-12749 | competition-form (WordPress plugin) | The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 1% |
| CVE-2024-32489 | tecnickcom/tcpdf | TCPDF Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-38073 | awesome-support (WordPress plugin), awesome-support/awesome-support | Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 | medium | 5.4 | 1% |
| CVE-2023-4453 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields | medium | 5.4 | 1% |
| CVE-2022-0955 | pimcore/data-hub | Cross-site Scripting in Pimcore Datahub | medium | 4.8 | 1% |
| CVE-2023-5774 | animated-counters (WordPress plugin) | The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, | medium | 6.4 | 1% |
| CVE-2024-0438 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age G | medium | 6.4 | 1% |
| CVE-2024-13219 | privacy-policy-genius (WordPress plugin) | The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.1 | 1% |
| CVE-2024-13220 | google-map-professional (WordPress plugin) | The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before ou | medium | 6.1 | 1% |
| CVE-2021-24415 | polo-video-gallery (WordPress plugin) | The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from | medium | 5.4 | 1% |
| CVE-2021-24416 | streamcast-radio-player (WordPress plugin) | The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing us | medium | 5.4 | 1% |
| CVE-2024-50803 | redaxo/source | Redaxo Core CMS Cross Site Scripting (XSS) | medium | 0.0 | 1% |
| CVE-2021-4372 | woocommerce-dynamic-pricing-and-discounts (WordPress plugin) | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and inclu | medium | 6.5 | 1% |
| CVE-2022-2695 | beaver-builder (WordPress plugin) | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to | medium | 6.4 | 1% |
| CVE-2019-25144 | wp-html-mail (WordPress plugin) | The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input san | medium | 5.4 | 1% |
| CVE-2024-12724 | wp-desklite (WordPress plugin) | The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 1% |
| CVE-2024-12732 | affiliateimportereb (WordPress plugin) | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leadi | medium | 6.1 | 1% |
| CVE-2024-12734 | advance-post-prefix (WordPress plugin) | The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a pa | medium | 6.1 | 1% |