Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-9172 | wp-file-upload (WordPress plugin) | The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. | medium | 5.4 | 3% |
| CVE-2022-0953 | download-anti-malware-security-and-brute-force-firewall (WordPress plugin) | The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outp | medium | 6.1 | 3% |
| CVE-2022-1597 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its | medium | 6.1 | 3% |
| CVE-2023-0827 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.3 | 3% |
| CVE-2013-2205 | WordPress core | The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote atta | medium | 4.3 | 3% |
| CVE-2019-16197 | dolibarr/dolibarr | Cross-site scripting in Dolibarr | medium | 6.1 | 3% |
| CVE-2021-24719 | enfold (WordPress plugin) | The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfol | medium | 6.1 | 3% |
| CVE-2018-1002001 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2017-12061 | mantisbt/mantisbt | MantisBT XSS allows unsanitized input via admin/install.php | medium | 6.1 | 3% |
| CVE-2022-28222 | antispam (WordPress plugin) | The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] paramet | medium | 6.1 | 3% |
| CVE-2016-1564 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to in | medium | 6.1 | 3% |
| CVE-2021-24235 | goto (WordPress plugin) | The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthe | medium | 6.1 | 3% |
| CVE-2020-13666 | drupal/core, drupal/drupal | The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting. | medium | 6.1 | 3% |
| CVE-2018-1002002 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2018-1002003 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2018-1002004 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2021-25120 | easy-social-feed (WordPress plugin) | The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outpu | medium | 6.1 | 3% |
| CVE-2016-1000130 | e-search (WordPress plugin) | Reflected XSS in wordpress plugin e-search v1.0 | medium | 6.1 | 3% |
| CVE-2018-20149 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended | medium | 5.4 | 3% |
| CVE-2017-14622 | 2kb-amazon-affiliates-store (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attack | medium | 6.1 | 3% |
| CVE-2018-6010 | yiisoft/yii2, yiisoft/yii2-dev | Yii Framework reflected Cross-site Scripting | high | 7.5 | 3% |
| CVE-2014-9098 | contus-video-gallery (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before | low | 3.5 | 3% |
| CVE-2017-5612 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7. | medium | 6.1 | 3% |
| CVE-2020-17362 | nova-lite (WordPress theme) | search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. | medium | 6.1 | 3% |
| CVE-2017-6814 | WordPress core | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) misha | medium | 5.4 | 3% |
| CVE-2021-24773 | download-manager (WordPress plugin) | The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing h | medium | 4.8 | 3% |
| CVE-2016-7168 | WordPress core | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might | medium | 4.8 | 3% |
| CVE-2014-9032 | WordPress core | Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows r | medium | 4.3 | 3% |
| CVE-2022-42094 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 3% |
| CVE-2017-9516 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 5.4 | 3% |
| CVE-2016-10993 | scoreme (WordPress theme) | The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter. | medium | 5.4 | 3% |
| CVE-2015-4039 | wp-membership (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inje | medium | 5.4 | 3% |
| CVE-2022-0994 | hummingbird (WordPress plugin) | The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as | medium | 4.8 | 3% |
| CVE-2019-20042 | WordPress core | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a | medium | 6.1 | 3% |
| CVE-2012-2403 | WordPress core | wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote | medium | 4.3 | 3% |
| CVE-2021-24596 | youforms-free-for-copecart (WordPress plugin) | The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege use | medium | 4.8 | 3% |
| CVE-2017-7725 | concrete5/concrete5 | Concrete CMS vulnerable to cross-site scripting (XSS) | medium | 6.1 | 3% |
| CVE-2013-2714 | podpress (WordPress plugin) | Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via th | medium | 6.1 | 3% |
| CVE-2019-12935 | shopware/shopware | Shopware Cross-site Scripting Vulnerability | medium | 6.1 | 3% |
| CVE-2017-14726 | WordPress core | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. | medium | 6.1 | 3% |
| CVE-2018-10309 | responsive-cookie-consent (WordPress plugin) | The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS. | medium | 5.4 | 3% |
| CVE-2022-2846 | calendar-event-multi-view (WordPress plugin) | The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event | medium | 4.3 | 3% |
| CVE-2023-37269 | wintercms/winter | Winter CMS stored XSS through privileged upload of SVG file | low | 2.0 | 3% |
| CVE-2015-4413 | nextend-facebook-connect (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plug | medium | 4.3 | 3% |
| CVE-2020-35125 | mautic/core | Mautic is vulnerable to XSS vulnerability | critical | 9.6 | 3% |
| CVE-2012-2404 | WordPress core | wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site | medium | 4.3 | 3% |
| CVE-2015-6584 | datatables/datatables | DataTable Vulnerable to Cross-Site Scripting | high | 0.0 | 3% |
| CVE-2020-10596 | opencart/opencart | Cross-site Scripting in OpenCart | medium | 5.4 | 3% |
| CVE-2015-6238 | google-analyticator (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to | medium | 4.3 | 3% |
| CVE-2011-0700 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web scrip | low | 3.5 | 3% |