Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-7938 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2023-3996 | armember-membership (WordPress plugin) | The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and i | medium | 4.4 | 1% |
| CVE-2024-3068 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cfs[fields][*][name]' parameter in all ver | medium | 4.4 | 1% |
| CVE-2026-21451 | bagisto/bagisto | Bagisto has HTML Filter Bypass that Enables Stored XSS | medium | 0.0 | 1% |
| CVE-2018-20682 | forkcms/forkcms | Fork CMS XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8092 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8117 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8120 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8128 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Scripting via store name | medium | 5.4 | 1% |
| CVE-2019-8129 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Scripting via Signifyd Guarantee Option Translation Override | medium | 5.4 | 1% |
| CVE-2019-8131 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8132 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8138 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8139 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8142 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8145 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Scripting via Attribute Set Name | medium | 5.4 | 1% |
| CVE-2019-8146 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8147 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2020-9311 | silverstripe/cms, silverstripe/framework | Silverstripe CMS XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2021-24265 | rife-elementor-extensions-\&-templates (WordPress plugin) | The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS | medium | 5.4 | 1% |
| CVE-2021-23209 | accelerated-mobile-pages (WordPress plugin) | Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile | medium | 4.8 | 1% |
| CVE-2024-2255 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 1% |
| CVE-2022-4647 | microweber/microweber | Microweber vulnerable to Stored Cross-Site Scripting | medium | 6.1 | 1% |
| CVE-2023-29009 | baserproject/basercms | baserCMS Cross-site Scripting Vulnerability in Favorites Feature | medium | 6.1 | 1% |
| CVE-2020-15514 | haffner/jh_captcha | jh_captcha for Typo3 XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2020-15517 | tpwd/ke_search | ke_search for Typo3 XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2021-28380 | aimeos/aimeos-typo3 | Aimeos Typo3 extension contains Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-34656 | polls-widget (WordPress plugin) | Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at | medium | 4.8 | 1% |
| CVE-2024-5727 | widget4call (WordPress plugin) | The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 4.7 | 1% |
| CVE-2025-51504 | microweber/microweber | Microweber XSS Vulnerability in the homepage Endpoint | medium | 0.0 | 1% |
| CVE-2023-4775 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, | medium | 6.4 | 1% |
| CVE-2023-5741 | powr-pack (WordPress plugin) | The POWR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'powr-powr-pack' shortcode in all versions up to | medium | 6.4 | 1% |
| CVE-2020-21246 | sheng/yiicms | YiiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-1115 | pimcore/pimcore | Pimcore vulnerable to Cross Site Scripting in Documents Link Editable | medium | 5.4 | 1% |
| CVE-2022-29438 | baslider (WordPress plugin) | Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 a | medium | 4.8 | 1% |
| CVE-2023-5664 | garden-gnome-package (WordPress plugin) | The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ggpkg' shortcode in all version | medium | 6.4 | 1% |
| CVE-2024-3728 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 1% |
| CVE-2022-29476 | 8-degree-notification-bar (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPres | medium | 6.1 | 1% |
| CVE-2024-9614 | constant-contact-forms-by-mailmunch (WordPress plugin) | The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg | medium | 6.1 | 1% |
| CVE-2022-40191 | mega-forms (WordPress plugin) | Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at W | medium | 5.4 | 1% |
| CVE-2022-41638 | pop-up (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) in Pop-Up Chop Chop plugin <= 2.1.7 on WordPress. | medium | 5.4 | 1% |
| CVE-2023-0709 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo | medium | 5.4 | 1% |
| CVE-2023-2753 | thorsten/phpmyfaq | phpMyFAQ vulnerable to stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2019-12186 | sylius/grid, sylius/grid-bundle, sylius/sylius | XSS injection in the Grid component of Sylius | medium | 4.8 | 1% |
| CVE-2019-8115 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-8148 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2023-2223 | login-rebuilder (WordPress plugin) | The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2015-10093 | mark-user-as-spammer (WordPress plugin) | A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vul | low | 2.6 | 1% |
| CVE-2024-34460 | tribalsystems/zenario | Zenario's Tree Explorer tool from Organizer affected by Cross-site Scripting | medium | 6.5 | 1% |
| CVE-2023-4840 | mappress-google-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to | medium | 6.4 | 1% |