Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2271 | wp-database-backup (WordPress plugin) | The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admi | medium | 4.8 | 1% |
| CVE-2024-24807 | sulu/sulu | Sulu HTML Injection via Autocomplete Suggestion | low | 0.0 | 1% |
| CVE-2023-5577 | wp-bitly (WordPress plugin) | The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, an | medium | 6.4 | 1% |
| CVE-2023-4913 | cecil/cecil | Cecil Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2020-36397 | lavalite/cms | LavaLite Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2019-8227 | magento/core | Magento XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2024-2734 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and | medium | 6.4 | 1% |
| CVE-2024-2735 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, | medium | 6.4 | 1% |
| CVE-2024-2736 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, | medium | 6.4 | 1% |
| CVE-2023-0479 | print-invoice-\&-delivery-notes-for-woocommerce (WordPress plugin) | The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an | medium | 6.1 | 1% |
| CVE-2024-21504 | livewire/livewire | Cross-site Scripting in livewire/livewire | medium | 6.1 | 1% |
| CVE-2024-57601 | alextselegidis/easyappointments | Remote code execution in alextselegidis/easyappointments | medium | 6.1 | 1% |
| CVE-2017-1000442 | passbolt/passbolt_api | Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar | medium | 5.4 | 1% |
| CVE-2020-20695 | gilacms/gila | Cross-site Scripting in GilaCMS | medium | 5.4 | 1% |
| CVE-2020-28124 | lavalite/cms | Cross Site Scripting (XSS) in LavaLite 5.8.0 | medium | 5.4 | 1% |
| CVE-2021-36398 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2021-36399 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-33154 | brotkrueml/schema | brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS | medium | 5.4 | 1% |
| CVE-2024-2091 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up t | medium | 5.4 | 1% |
| CVE-2024-2733 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Separator" element in all versions | medium | 5.4 | 1% |
| CVE-2021-36827 | ninja-forms (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via | medium | 4.8 | 1% |
| CVE-2023-2584 | pixelyoursite (WordPress plugin), pixelyoursite-pro (WordPress plugin) | The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3 | medium | 4.4 | 1% |
| CVE-2024-0187 | peepso (WordPress plugin) | The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting | medium | 6.1 | 1% |
| CVE-2022-3096 | wp-total-hacks (WordPress plugin) | The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allo | medium | 5.4 | 1% |
| CVE-2023-4890 | jquery-vertical-accordion-menu (WordPress plugin) | The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in | medium | 6.4 | 1% |
| CVE-2023-5086 | copy-the-code (WordPress plugin) | The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2023-5308 | podcast-subscribe-buttons (WordPress plugin) | The Podcast Subscribe Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'podcast_subscribe' shortcode in version | medium | 6.4 | 1% |
| CVE-2025-4652 | broadstreet (WordPress plugin) | The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 1% |
| CVE-2021-41952 | tribalsystems/zenario | Cross-site Scripting in Zenario CMS | medium | 4.8 | 1% |
| CVE-2013-10022 | contact-form (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this | low | 3.5 | 1% |
| CVE-2015-10121 | beeliked (WordPress plugin) | A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic. Affected by this vulnera | low | 3.5 | 1% |
| CVE-2021-4452 | google-language-translator (WordPress plugin) | The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up t | high | 7.1 | 1% |
| CVE-2024-45962 | october/october | October allows an admin account to upload PDF containing malicious JavaScript | medium | 4.8 | 1% |
| CVE-2025-12019 | featured-image (WordPress plugin) | The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including | medium | 4.4 | 1% |
| CVE-2025-55166 | enshrined/svg-sanitize | svg-sanitizer Bypasses Attribute Sanitization | medium | 0.0 | 1% |
| CVE-2022-44590 | simple-video-embedder (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress. | medium | 6.4 | 1% |
| CVE-2024-0448 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget URL parameters in | medium | 6.4 | 1% |
| CVE-2024-1296 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block upload in all versions up | medium | 6.4 | 1% |
| CVE-2024-1894 | burst-statistics (WordPress plugin) | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b | medium | 6.4 | 1% |
| CVE-2023-28604 | sitegeist/fluid-components | Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting | medium | 6.1 | 1% |
| CVE-2023-5745 | reusable-text-blocks (WordPress plugin) | The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, an | medium | 5.5 | 1% |
| CVE-2020-36395 | lavalite/cms | Stored XSS in LavaLite 5.8.0 | medium | 5.4 | 1% |
| CVE-2022-44380 | snipe/snipe-it | Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets | medium | 5.4 | 1% |
| CVE-2021-36830 | comment-guestbook (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress. | medium | 4.8 | 1% |
| CVE-2021-36839 | social-media-buttons-toolbar (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress. | medium | 4.8 | 1% |
| CVE-2024-0602 | yet-another-related-posts-plugin (WordPress plugin) | The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ver | medium | 4.4 | 1% |
| CVE-2022-4408 | thorsten/phpmyfaq | phpMyFAQ vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2024-47836 | admidio/admidio | Admidio Vulnerable to HTML Injection In The Messages Section | low | 3.5 | 1% |
| CVE-2023-2433 | yet-another-related-posts-plugin (WordPress plugin) | The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30 | medium | 6.4 | 1% |
| CVE-2023-4283 | embedpress (WordPress plugin) | The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, | medium | 6.4 | 1% |