Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4265 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 1% |
| CVE-2023-4471 | order-tracking (WordPress plugin) | The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in ve | medium | 6.1 | 1% |
| CVE-2022-3897 | wp-affiliate-platform (WordPress plugin) | The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and in | medium | 5.5 | 1% |
| CVE-2017-11127 | bolt/bolt | Bolt CMS Stored XSS | medium | 5.4 | 1% |
| CVE-2017-11128 | bolt/bolt | Bolt stored Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2018-7302 | tikiwiki/tiki-manager | Tiki Wiki CMS XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2024-28593 | moodle/moodle | Cross-site Scripting in Moodle Chat | medium | 5.4 | 1% |
| CVE-2025-46549 | yeswiki/yeswiki | Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting | medium | 5.3 | 1% |
| CVE-2025-46550 | yeswiki/yeswiki | Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting | medium | 5.3 | 1% |
| CVE-2024-1037 | all-in-one-wp-security-and-firewall (WordPress plugin) | The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' pa | medium | 6.1 | 1% |
| CVE-2022-44628 | 4ecps-webforms (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress. | medium | 5.9 | 1% |
| CVE-2021-36858 | super-testimonial (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themepoints Testimonials plugin <= 2.6 on WordPress. | medium | 4.8 | 1% |
| CVE-2022-0446 | simple-banner (WordPress plugin) | The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users | medium | 4.8 | 1% |
| CVE-2022-35275 | woo-order-export-lite (WordPress plugin) | Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin < | medium | 4.8 | 1% |
| CVE-2022-35725 | wp-forecast (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-36356 | culture-object (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at Wo | medium | 4.8 | 1% |
| CVE-2022-36428 | rock-convert (WordPress plugin) | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress. | medium | 4.8 | 1% |
| CVE-2022-37335 | wha-wordsearch (WordPress plugin) | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin <= 2.0.1 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-37403 | add-user-role (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-37404 | add2fav (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-37412 | better-delete-revision (WordPress plugin) | Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at Word | medium | 4.8 | 1% |
| CVE-2022-38068 | export-post-info (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-40311 | analytics-cat (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress. | medium | 4.8 | 1% |
| CVE-2022-44576 | agenteasy-properties (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in AgentEasy Properties plugin <= 1.0.4 on WordPress. | medium | 4.8 | 1% |
| CVE-2022-44586 | am-hili-affiliate-manager-for-publishers (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) in Ayoub Media AM-HiLi plugin <= 1.0 on WordPress. | medium | 4.8 | 1% |
| CVE-2023-7236 | backup-bolt (WordPress plugin) | The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it | medium | 4.7 | 1% |
| CVE-2023-49337 | concrete5/concrete5 | Concrete CMS Stored XSS | low | 2.4 | 1% |
| CVE-2024-1536 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | high | 7.4 | 1% |
| CVE-2024-13569 | front-end-users (WordPress plugin) | The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 1% |
| CVE-2021-42367 | variation-swatches-for-woocommerce (WordPress plugin) | The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/i | medium | 6.4 | 1% |
| CVE-2022-22109 | bottelet/flarepoint | Cross-site Scripting in DayByDay CRM | medium | 5.4 | 1% |
| CVE-2022-3539 | super-testimonials (WordPress plugin) | The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, a | medium | 4.8 | 1% |
| CVE-2022-3631 | oauth-client (WordPress plugin) | The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high | medium | 4.8 | 1% |
| CVE-2024-12638 | bulk-me-now\! (WordPress plugin) | The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | high | 7.1 | 1% |
| CVE-2024-2907 | absolutely-glamorous-custom-admin (WordPress plugin) | The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 6.8 | 1% |
| CVE-2024-10102 | robo-gallery (WordPress plugin) | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery setti | low | 2.7 | 1% |
| CVE-2019-25216 | rich-review (WordPress plugin) | The Rich Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the POST body 'update' parameter in versions up to, an | high | 7.2 | 1% |
| CVE-2023-4716 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up | medium | 6.4 | 1% |
| CVE-2023-3822 | pimcore/pimcore | Pimcore Cross-site Scripting vulnerability | medium | 6.0 | 1% |
| CVE-2021-24470 | yada-wiki (WordPress plugin) | The Yada Wiki WordPress plugin before 3.4.1 did not sanitise, validate or escape the anchor attribute of its shortcode, leading to a Stored | medium | 5.4 | 1% |
| CVE-2021-24659 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored C | medium | 5.4 | 1% |
| CVE-2022-0394 | remdex/livehelperchat | Cross-site Scripting in LiveHelperChat | medium | 5.4 | 1% |
| CVE-2022-0937 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-0940 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2021-24428 | yandex-turbo (WordPress plugin) | The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in | medium | 4.8 | 1% |
| CVE-2024-1720 | user-registration (WordPress plugin) | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored | medium | 4.7 | 1% |
| CVE-2026-54002 | getkirby/cms | Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` | high | 0.0 | 1% |
| CVE-2023-4841 | feeds-for-youtube (WordPress plugin) | The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2023-6923 | matomo (WordPress plugin) | The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite | medium | 6.1 | 1% |
| CVE-2020-20697 | khodakhah/nodcms | NodCMS Cross Site Scripting vulnerability | medium | 4.8 | 1% |