Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13619 | lifterlms (WordPress plugin) | The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2023-44761 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-47125 | typo3/html-sanitizer | Bypassing Cross-Site Scripting Protection in TYPO3 HTML Sanitizer | medium | 4.7 | 1% |
| CVE-2026-52854 | mediawiki/maps | mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function | high | 8.6 | 1% |
| CVE-2024-0381 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe- | medium | 6.4 | 1% |
| CVE-2023-37280 | pimcore/admin-ui-classic-bundle | Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page | medium | 6.1 | 1% |
| CVE-2024-2020 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all version | high | 7.2 | 1% |
| CVE-2024-3901 | genesis-blocks (WordPress plugin) | The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possi | medium | 6.8 | 1% |
| CVE-2022-3415 | chat-bubble (WordPress plugin) | The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attacker | medium | 6.1 | 1% |
| CVE-2021-24471 | youtube-embed (WordPress plugin) | The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XS | medium | 5.4 | 1% |
| CVE-2022-34658 | download-manager (WordPress plugin) | Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at | medium | 5.4 | 1% |
| CVE-2022-36355 | easy-org-chart (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Easy Org Chart plugin <= 3.1 at WordPress. | medium | 5.4 | 1% |
| CVE-2021-24531 | charitable (WordPress plugin) | The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability wh | medium | 5.4 | 1% |
| CVE-2023-3469 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting | medium | 5.2 | 1% |
| CVE-2022-37059 | intelliants/subrion | Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel | medium | 4.8 | 1% |
| CVE-2023-2630 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) vulnerability in Admin Translations | medium | 4.8 | 1% |
| CVE-2023-28850 | pimcore/perspective-editor | Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name | medium | 6.1 | 1% |
| CVE-2018-16638 | evolutioncms/evolution | Evolution CMS Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2023-0708 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to ech | medium | 5.4 | 1% |
| CVE-2023-4395 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.1 | 1% |
| CVE-2023-0446 | youtube-channel (WordPress plugin) | The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and | medium | 5.5 | 1% |
| CVE-2022-23896 | admidio/admidio | Cross-site Scripting in admidio | medium | 5.4 | 1% |
| CVE-2023-4719 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, | high | 7.2 | 1% |
| CVE-2024-13330 | justrows-free (WordPress plugin) | The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a | high | 7.1 | 1% |
| CVE-2024-13625 | tube-video-ads-lite (WordPress plugin) | The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leadi | high | 7.1 | 1% |
| CVE-2024-1535 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 1% |
| CVE-2022-33156 | brotkrueml/typo3-matomo-integration | brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting | medium | 6.1 | 1% |
| CVE-2022-33157 | subhh/libconnect | libconnect Extension for Typo3 Vulnerable to XSS | medium | 6.1 | 1% |
| CVE-2022-4838 | clean-login (WordPress plugin) | The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2023-44771 | tribalsystems/zenario | Zenario CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2021-36843 | floating-social-media-icon (WordPress plugin) | Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) | medium | 4.8 | 1% |
| CVE-2021-36920 | download-monitor (WordPress plugin) | Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6). | medium | 4.8 | 1% |
| CVE-2021-24642 | scroll-banner (WordPress plugin) | The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, esca | medium | 6.5 | 1% |
| CVE-2024-1519 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.5 | 1% |
| CVE-2024-3550 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode( | medium | 6.4 | 1% |
| CVE-2024-3743 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group, Shape Separator, C | medium | 6.4 | 1% |
| CVE-2024-26128 | baserproject/basercms | baserCMS Cross-site Scripting vulnerability in Content Management | medium | 5.4 | 1% |
| CVE-2021-36866 | easy-pricing-tables (WordPress plugin) | Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at | medium | 4.8 | 1% |
| CVE-2022-34648 | uploading-svgwebp-and-ico-files (WordPress plugin) | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 | medium | 4.8 | 1% |
| CVE-2022-36343 | enable-svg-webp-ico-upload (WordPress plugin) | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plug | low | 3.4 | 1% |
| CVE-2024-13094 | wp-triggers-lite (WordPress plugin) | The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 1% |
| CVE-2021-36867 | wp-testing (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possib | medium | 5.4 | 1% |
| CVE-2021-36912 | google-news-sitemap (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have | medium | 5.4 | 1% |
| CVE-2023-0310 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-25612 | simple-event-planner (WordPress plugin) | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user w | medium | 4.1 | 1% |
| CVE-2022-29433 | nd-donations (WordPress plugin) | Authenticated (contributor or higher role) Cross-Site Scripting (XSS) vulnerability in Donations plugin <= 1.8 on WordPress. | medium | 4.1 | 1% |
| CVE-2013-10026 | mail-subscribe-list (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress. This issue aff | low | 3.5 | 1% |
| CVE-2022-37328 | timeline-awesome (WordPress plugin) | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress. | low | 3.4 | 1% |
| CVE-2024-3045 | woocommerce-pdf-invoices-packing-slips (WordPress plugin) | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in | high | 7.2 | 1% |
| CVE-2021-46889 | photo-gallery (WordPress plugin) | The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covere | medium | 6.1 | 1% |