Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-3938 | snipe/snipe-it | snipe-it is vulnerable to Cross-site Scripting | low | 3.9 | 1% |
| CVE-2023-1878 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via adminlog | high | 8.3 | 1% |
| CVE-2023-3531 | nilsteampassnet/teampass | TeamPass Cross-site Scripting vulnerability | high | 8.1 | 1% |
| CVE-2024-0609 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Store | high | 7.2 | 1% |
| CVE-2023-0314 | thorsten/phpmyfaq | phpMyFAQ Reflected Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2018-5215 | forkcms/forkcms | Fork CMS XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2023-3191 | nilsteampassnet/teampass | Teampass Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2025-51503 | microweber/microweber | Microweber Has Stored XSS Vulnerability in User Profile Fields | low | 0.0 | 1% |
| CVE-2023-1758 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter | high | 8.9 | 1% |
| CVE-2024-39403 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) vulnerability | high | 7.6 | 1% |
| CVE-2023-5470 | etsy-shop (WordPress plugin) | The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, | medium | 6.4 | 1% |
| CVE-2024-10172 | void-visual-whmcs-element (WordPress plugin) | The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's void_wbwhmcse | medium | 6.4 | 1% |
| CVE-2010-10004 | simplesamlphp/simplesamlphp-module-infocard | Information Cards Module vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-23179 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them | medium | 4.8 | 1% |
| CVE-2023-5842 | dolibarr/dolibarr | Cross-site Scripting (XSS) in dolibarr/dolibarr | medium | 4.8 | 1% |
| CVE-2023-0553 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, a | medium | 4.4 | 1% |
| CVE-2023-2452 | advanced-woo-search (WordPress plugin) | The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and includi | medium | 4.4 | 1% |
| CVE-2024-0618 | fluentform (WordPress plugin) | The Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cro | medium | 4.4 | 1% |
| CVE-2024-3588 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block in all vers | medium | 6.4 | 1% |
| CVE-2021-4303 | xataface/xataface | Xataface vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2023-5541 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2023-5547 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-29426 | 2j-slideshow (WordPress plugin) | Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image S | medium | 5.4 | 1% |
| CVE-2023-1090 | smtp-mailing-queue (WordPress plugin) | The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2021-31778 | amazing/media2click | Cross-site scripting in media2click | medium | 6.4 | 1% |
| CVE-2024-10851 | razorpay-payment-button (WordPress plugin) | The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & re | medium | 6.1 | 1% |
| CVE-2021-24660 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as l | medium | 5.4 | 1% |
| CVE-2022-4650 | hashbar (WordPress plugin) | The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role | medium | 5.4 | 1% |
| CVE-2022-4699 | mediaelement.js (WordPress plugin) | The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2022-4765 | portfolio-for-elementor (WordPress plugin) | The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 1% |
| CVE-2022-4837 | cpo-companion (WordPress plugin) | The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2023-0079 | customer-reviews-for-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before out | medium | 5.4 | 1% |
| CVE-2023-0231 | shoplentor (WordPress plugin) | The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/po | medium | 5.4 | 1% |
| CVE-2023-0419 | shortcode-for-font-awesome (WordPress plugin) | The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting | medium | 5.4 | 1% |
| CVE-2026-45368 | getkirby/cms | Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend | high | 0.0 | 1% |
| CVE-2024-29374 | moodle/moodle | Cross site scripting in moodle | medium | 6.1 | 1% |
| CVE-2023-0787 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | 1% |
| CVE-2024-8291 | concrete5/concrete5 | Cross site scripting in Concrete CMS | medium | 4.8 | 1% |
| CVE-2023-1757 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via FAQ News link parameter | high | 8.1 | 1% |
| CVE-2023-1882 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter | high | 8.1 | 1% |
| CVE-2023-5864 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | high | 7.4 | 1% |
| CVE-2023-3387 | lana-text-to-image (WordPress plugin) | The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lana_text_to_image' and 'lana_text_to_img' | medium | 6.4 | 1% |
| CVE-2024-0700 | simple-tweet (WordPress plugin) | The Simple Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tweet this text value in all versions up to, and | medium | 6.4 | 1% |
| CVE-2024-1074 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the audio widget 'link_url | medium | 6.4 | 1% |
| CVE-2024-1497 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form widget addr2_width attribute in al | medium | 6.4 | 1% |
| CVE-2024-1499 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in the $settings[ | medium | 6.4 | 1% |
| CVE-2024-1541 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htm | medium | 6.4 | 1% |
| CVE-2025-1517 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 1% |
| CVE-2023-1760 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 4.8 | 1% |
| CVE-2024-53864 | ibexa/admin-ui | Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern | medium | 0.0 | 1% |