Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-29449 | opal-hotel-room-booking (WordPress plugin) | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 a | medium | 4.1 | 1% |
| CVE-2013-10028 | eelv-newsletter (WordPress plugin) | A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the functi | low | 3.5 | 1% |
| CVE-2014-125095 | contact-form (WordPress plugin) | A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the | low | 3.5 | 1% |
| CVE-2014-125096 | fancy-gallery (WordPress plugin) | A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability i | low | 3.5 | 1% |
| CVE-2015-10110 | room-spy (WordPress plugin) | A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability af | low | 3.5 | 1% |
| CVE-2015-10120 | wds-multisite-aggregate (WordPress plugin) | A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the | low | 3.5 | 1% |
| CVE-2022-0705 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2022-37330 | wha-crossword (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress. | medium | 5.4 | 1% |
| CVE-2014-125105 | broken-link-checker (WordPress plugin) | A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vul | low | 2.4 | 1% |
| CVE-2015-10094 | fastly (WordPress plugin) | A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this issue is the function | low | 2.4 | 1% |
| CVE-2023-28429 | pimcore/pimcore | Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field | medium | 6.1 | 1% |
| CVE-2023-6632 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and includ | medium | 6.1 | 1% |
| CVE-2023-28471 | concrete5/concrete5 | Stored cross site scripting via container name | medium | 5.4 | 1% |
| CVE-2023-28476 | concrete5/concrete5 | Stored cross site scripting on tags | medium | 5.4 | 1% |
| CVE-2023-24230 | getformwork/formwork | Formwork Cross-site Scripting (XSS) from Page title field | medium | 4.8 | 1% |
| CVE-2020-5226 | simplesamlphp/simplesamlphp | Cross-site scripting in SimpleSAMLphp | medium | 4.4 | 1% |
| CVE-2023-6954 | download-manager (WordPress plugin) | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 1% |
| CVE-2024-3341 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_gm | medium | 6.4 | 1% |
| CVE-2024-3724 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Stack Group, Photo S | medium | 6.4 | 1% |
| CVE-2022-3211 | pimcore/pimcore | Pimcore vulnerable to stored stored Cross-site Scripting via`properties` when creating new users | medium | 5.4 | 1% |
| CVE-2023-6524 | mappress-google-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all version | medium | 6.4 | 1% |
| CVE-2021-24344 | easy-preloader (WordPress plugin) | The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site | medium | 4.8 | 1% |
| CVE-2024-28106 | phpmyfaq/phpmyfaq | phpMyFAQ Stored Cross-site Scripting at FAQ News Content | medium | 4.3 | 1% |
| CVE-2025-3742 | responsive-lightbox (WordPress plugin) | The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them b | medium | 6.8 | 1% |
| CVE-2022-43120 | intelliants/subrion | Subrion CMS is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2021-32245 | pagekit/pagekit | Cross-site scripting in PageKit | medium | 5.4 | 1% |
| CVE-2022-0966 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2023-2752 | thorsten/phpmyfaq | phpMyFAQ vulnerable to stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2024-9548 | wp-slimstat (WordPress plugin) | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, a | high | 7.2 | 1% |
| CVE-2023-5469 | drop-shadow-boxes (WordPress plugin) | The Drop Shadow Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dropshadowbox' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2023-5658 | wp-mapit (WordPress plugin) | The WP MapIt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_mapit' shortcode in all versions up to, | medium | 6.4 | 1% |
| CVE-2023-5662 | wp-sponsors (WordPress plugin) | The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, | medium | 6.4 | 1% |
| CVE-2023-5743 | telephone-number-linker (WordPress plugin) | The Telephone Number Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'telnumlink' shortcode in all | medium | 6.4 | 1% |
| CVE-2024-1425 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for Wor | medium | 6.4 | 1% |
| CVE-2020-11064 | typo3/cms, typo3/cms-core | Cross-Site Scripting in TYPO3 CMS Form Engine | medium | 5.4 | 1% |
| CVE-2020-11065 | typo3/cms, typo3/cms-core | Cross-Site Scripting in TYPO3 CMS Link Handling | medium | 5.4 | 1% |
| CVE-2020-11070 | t3g/svg-sanitizer | Cross-Site Scripting in SVG Sanitizer | medium | 5.4 | 1% |
| CVE-2020-13459 | verbb/image-resizer | Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action | medium | 5.4 | 1% |
| CVE-2020-13869 | verbb/comments | Comments plugin stored Cross-site Scripting via a guest name | medium | 5.4 | 1% |
| CVE-2020-13870 | verbb/comments | Comments plugin stored Cross-site Scripting (XSS) via an asset volume name | medium | 5.4 | 1% |
| CVE-2022-28803 | silverstripe/framework | Stored XSS in link tags added via XHR in SilverStripe Framework | medium | 5.4 | 1% |
| CVE-2022-29418 | night-mode (WordPress plugin) | Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on WordPress via vulnerable | medium | 4.8 | 1% |
| CVE-2024-0445 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's element attributes in a | medium | 6.4 | 1% |
| CVE-2022-4453 | 3d-flipbook (WordPress plugin) | The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2022-4480 | click-to-chat (WordPress plugin) | The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 1% |
| CVE-2024-28108 | phpmyfaq/phpmyfaq | phpMyFAQ Stored HTML Injection at contentLink | medium | 5.1 | 1% |
| CVE-2022-0834 | amelia (WordPress plugin) | The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter fo | high | 7.2 | 1% |
| CVE-2024-47524 | librenms/librenms | LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name | high | 7.2 | 1% |
| CVE-2022-40487 | processwire/processwire | ProcessWire vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-2300 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |