Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-4433 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.3 | 1% |
| CVE-2021-24467 | leaflet-map (WordPress plugin) | The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logg | medium | 6.5 | 1% |
| CVE-2023-49833 | spectra (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress G | medium | 6.5 | 1% |
| CVE-2021-34668 | real-media-library (WordPress plugin) | The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides | medium | 6.4 | 1% |
| CVE-2023-2428 | thorsten/phpmyfaq | phpMyFAQ vulnerable to Stored Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-1750 | sticky-popup (WordPress plugin) | The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and i | medium | 5.5 | 1% |
| CVE-2022-29440 | promotion-slider (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3 | medium | 5.4 | 1% |
| CVE-2022-29442 | private-messages-for-wordpress (WordPress plugin) | Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For WordPress <= 2.1.10 at WordPr | medium | 5.4 | 1% |
| CVE-2025-51488 | moonshine/moonshine | moonshine Stored Cross-Site Scripting Vulnerability in Create Admin | medium | 4.9 | 1% |
| CVE-2018-16630 | getkirby/kirby | Kirby XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2022-4242 | wp-google-review-slider (WordPress plugin) | The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-36390 | calendar-event (WordPress plugin) | Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at Wor | medium | 4.1 | 1% |
| CVE-2012-10013 | backend-localization (WordPress plugin) | A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affe | low | 3.5 | 1% |
| CVE-2012-10014 | backend-localization (WordPress plugin) | A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function b | low | 3.5 | 1% |
| CVE-2013-10021 | debug-bar (WordPress plugin) | A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerabili | low | 3.5 | 1% |
| CVE-2015-10092 | qtranslate-slug (WordPress plugin) | A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the functi | low | 3.5 | 1% |
| CVE-2015-10098 | broken-link-checker (WordPress plugin) | A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue | low | 3.5 | 1% |
| CVE-2021-4074 | whmcs-bridge (WordPress plugin) | The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-br | medium | 6.4 | 1% |
| CVE-2023-0791 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | 1% |
| CVE-2023-0794 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | 1% |
| CVE-2023-1069 | complianz (WordPress plugin), really-simple-plugins/complianz-gdpr | The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcod | medium | 5.4 | 1% |
| CVE-2023-4520 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter s | medium | 5.4 | 1% |
| CVE-2024-23817 | dolibarr/dolibarr | Dolibarr Application Home Page has HTML injection vulnerability | high | 7.1 | 1% |
| CVE-2022-2517 | beaver-builder (WordPress plugin) | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value as | medium | 6.4 | 1% |
| CVE-2023-5049 | rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'raffl | medium | 6.4 | 1% |
| CVE-2023-5638 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, a | medium | 6.4 | 1% |
| CVE-2024-0382 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, a | medium | 6.4 | 1% |
| CVE-2024-0384 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Notes in all versions up to, and including, | medium | 6.4 | 1% |
| CVE-2021-35955 | contao/contao, contao/core-bundle | Cross site scripting via HTML attributes in the back end | medium | 5.9 | 1% |
| CVE-2021-36871 | wp-go-maps (WordPress plugin) | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1 | medium | 5.5 | 1% |
| CVE-2013-4791 | prestashop/prestashop | PrestaShop Stored Cross-Site Scripting Vulnerability | medium | 5.4 | 1% |
| CVE-2019-7853 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7862 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7863 | magento/community-edition, magento/product-community-edition | Magento Stored cross-site scripting in admin panel | medium | 4.8 | 1% |
| CVE-2019-7866 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7867 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7868 | magento/community-edition, magento/product-community-edition | Magento Cross-site Scripting in the admin panel | medium | 4.8 | 1% |
| CVE-2019-7869 | magento/community-edition, magento/product-community-edition | Magento Stored Cross-site Scripting vulnerability in the admin panel | medium | 4.8 | 1% |
| CVE-2019-7875 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7880 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7887 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7897 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7908 | magento/community-edition, magento/product-community-edition | Magento Cross-site Scripting in the admin panel | medium | 4.8 | 1% |
| CVE-2019-7909 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7926 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7927 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7934 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7935 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7936 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7937 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |