Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-25849 | joyqi/hyper-down | HyperDown vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2023-3821 | pimcore/pimcore | Pimcore Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2018-16637 | evolutioncms/evolution | Evolution CMS Stored Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2022-37430 | silverstripe/framework | Stored XSS using uppercase characters in HTMLEditor | medium | 5.4 | 1% |
| CVE-2022-38147 | silverstripe/assets | XSS via uploaded gpx file | medium | 5.4 | 1% |
| CVE-2021-36832 | icegram (WordPress plugin) | WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][h | medium | 4.8 | 1% |
| CVE-2021-36884 | backup-backup (WordPress plugin) | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions. | medium | 4.8 | 1% |
| CVE-2021-36911 | comment-engine-pro (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by u | medium | 4.8 | 1% |
| CVE-2023-46735 | symfony/symfony, symfony/webhook | Symfony potential Cross-site Scripting in WebhookController | medium | 6.1 | 1% |
| CVE-2022-38460 | notice-board (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress. | medium | 5.4 | 1% |
| CVE-2022-25604 | pricetable (WordPress plugin) | Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin ( | medium | 4.1 | 1% |
| CVE-2023-6486 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS metabox in all | medium | 6.4 | 1% |
| CVE-2024-28709 | limesurvey/limesurvey | LimeSurvey Cross Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2024-28710 | limesurvey/limesurvey | LimeSurvey Cross Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-2716 | beaver-builder (WordPress plugin) | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Editor' block in versio | medium | 6.4 | 1% |
| CVE-2022-2934 | beaver-builder (WordPress plugin) | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image URL' value found in th | medium | 6.4 | 1% |
| CVE-2023-4945 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in versions up to, and | medium | 6.4 | 1% |
| CVE-2019-7882 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-7921 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 5.4 | 1% |
| CVE-2019-7944 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-7945 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2022-37247 | craftcms/cms | Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page | medium | 5.4 | 1% |
| CVE-2023-0306 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-25606 | wp-downloadmanager (WordPress plugin) | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68 | medium | 4.8 | 1% |
| CVE-2019-25094 | innologi/typo3-appointments | typo3-appointments vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2021-36919 | awesome-support (WordPress plugin) | Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnera | medium | 6.1 | 1% |
| CVE-2018-16629 | intelliants/subrion | Subrion CMS XSS | medium | 4.8 | 1% |
| CVE-2022-23979 | ultimate-reviews (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15). | medium | 4.8 | 1% |
| CVE-2022-29422 | countdown-builder (WordPress plugin) | Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock plugin <= 2.3.2 at W | medium | 4.8 | 1% |
| CVE-2022-33191 | testimonials (WordPress plugin) | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0 | medium | 4.1 | 1% |
| CVE-2022-34650 | adl-team (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at | medium | 4.1 | 1% |
| CVE-2022-34853 | adl-team (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 | medium | 4.1 | 1% |
| CVE-2021-36844 | wp-subscribe (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin <= 1.2.12 on WordPress. | low | 3.4 | 1% |
| CVE-2022-3975 | nukeviet/nukeviet | NukeView CMS vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2023-2708 | video-slider-with-thumbnails (WordPress plugin) | The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, an | medium | 6.1 | 1% |
| CVE-2024-1806 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 1% |
| CVE-2017-9070 | modx/revolution | MODX Revolution cross-site scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-2322 | pimcore/pimcore | Cross-site Scripting (XSS) in Document Properties Parameter | medium | 5.2 | 1% |
| CVE-2022-25605 | wp-downloadmanager (WordPress plugin) | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68 | medium | 4.8 | 1% |
| CVE-2023-48295 | librenms/librenms | LibreNMS Cross-site Scripting at Device groups Deletion feature | medium | 6.3 | 1% |
| CVE-2023-2119 | responsive-filterable-portfolio (WordPress plugin) | The Responsive Filterable Portfolio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in ve | medium | 6.1 | 1% |
| CVE-2021-41502 | intelliants/subrion | Cross site scripting in intelliants/subrion | medium | 5.4 | 1% |
| CVE-2023-0373 | lightweight-accordion (WordPress plugin) | The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back | medium | 5.4 | 1% |
| CVE-2022-25603 | maxgalleria (WordPress plugin) | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versi | medium | 4.8 | 1% |
| CVE-2023-5228 | user-registration (WordPress plugin) | The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege us | medium | 4.8 | 1% |
| CVE-2024-13352 | legull (WordPress plugin) | The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | high | 7.1 | 1% |
| CVE-2023-4842 | social-warfare (WordPress plugin) | The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode | medium | 6.4 | 1% |
| CVE-2023-0162 | cpo-companion (WordPress plugin) | The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in v | medium | 5.5 | 1% |
| CVE-2023-0295 | launchpad-by-obox (WordPress plugin) | The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, an | medium | 5.5 | 1% |
| CVE-2022-35933 | prestashop/productcomments | PrestaShop Product Comments Cross-site Scripting vulnerability | medium | 4.3 | 1% |