Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-25080 | mobiledetect/mobiledetectlib | Cross-site Scripting in MobileDetect | medium | 6.1 | 3% |
| CVE-2015-8350 | cta (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to injec | medium | 6.1 | 3% |
| CVE-2022-2174 | microweber/microweber | Cross-site Scripting in Microweber | medium | 6.1 | 3% |
| CVE-2018-19041 | media-file-manager (WordPress plugin) | The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax | medium | 6.1 | 3% |
| CVE-2015-7873 | phpmyadmin/phpmyadmin | phpMyAdmin allows remote attackers to spoof content via the url parameter | high | 0.0 | 3% |
| CVE-2020-28038 | WordPress core | WordPress before 5.5.2 allows stored XSS via post slugs. | medium | 6.1 | 3% |
| CVE-2017-6818 | WordPress core | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. | medium | 6.1 | 3% |
| CVE-2018-1002009 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2010-1593 | silverstripe/cms, silverstripe/framework | SilverStripe vulnerable to Cross-site Scripting | low | 0.0 | 3% |
| CVE-2015-1436 | easing-slider (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrar | medium | 4.3 | 3% |
| CVE-2021-24407 | jannah (WordPress plugin) | The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to | medium | 6.1 | 3% |
| CVE-2020-36510 | 15zine (WordPress plugin) | The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s | medium | 6.1 | 3% |
| CVE-2019-20211 | citybook (WordPress plugin), easybook (WordPress plugin), townhub (WordPress plugin) | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing A | medium | 6.1 | 3% |
| CVE-2019-20212 | citybook (WordPress plugin), easybook (WordPress plugin), townhub (WordPress plugin) | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat | medium | 6.1 | 3% |
| CVE-2018-1002007 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2018-1002008 | bft-autoresponder (WordPress plugin) | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ | medium | 4.8 | 3% |
| CVE-2009-3696 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting In MySQL Table Name | medium | 0.0 | 3% |
| CVE-2017-14724 | WordPress core | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. | medium | 6.1 | 3% |
| CVE-2015-3904 | roomcloud (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress allow remote attackers | medium | 4.3 | 3% |
| CVE-2020-4049 | WordPress core | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript | low | 2.4 | 3% |
| CVE-2023-0586 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and inc | medium | 6.4 | 3% |
| CVE-2016-6634 | WordPress core | Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary we | medium | 6.1 | 3% |
| CVE-2011-4956 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspec | medium | 4.3 | 3% |
| CVE-2014-7958 | bulletproof-security (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allow | medium | 4.3 | 3% |
| CVE-2012-6511 | organizer (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote att | medium | 4.3 | 3% |
| CVE-2007-4165 | blue-memories-theme (WordPress theme) | Cross-site scripting (XSS) vulnerability in index.php in the Blue Memories theme 1.5 for WordPress allows remote attackers to inject arbitra | medium | 4.3 | 3% |
| CVE-2021-24351 | the-plus-addons-for-elementor (WordPress plugin) | The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise som | medium | 6.1 | 2% |
| CVE-2012-0287 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows rem | low | 2.6 | 2% |
| CVE-2013-0236 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML | medium | 4.3 | 2% |
| CVE-2023-4451 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | medium | 6.1 | 2% |
| CVE-2021-24383 | wp-go-maps (WordPress plugin) | The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin | medium | 5.4 | 2% |
| CVE-2008-3218 | drupal/drupal | Drupal vulnerable to Cross-site Scripting | medium | 0.0 | 2% |
| CVE-2019-20173 | login-by-auth0 (WordPress plugin) | The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. | medium | 6.1 | 2% |
| CVE-2012-4437 | smarty/smarty | Cross-site Scripting in SmartyException | medium | 0.0 | 2% |
| CVE-2014-7182 | wp-google-maps (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to injec | medium | 4.3 | 2% |
| CVE-2017-5490 | WordPress core | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7. | medium | 6.1 | 2% |
| CVE-2021-34643 | skaut-bazar (WordPress plugin) | The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar | medium | 6.1 | 2% |
| CVE-2018-10366 | rainlab/user-plugin | User Plugin for October CSS Allows XSS | medium | 6.1 | 2% |
| CVE-2020-35124 | mautic/core | XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic | critical | 0.0 | 2% |
| CVE-2017-16807 | getkirby/cms | Kirby XSS Vulnerability | medium | 5.4 | 2% |
| CVE-2014-9035 | WordPress core | Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0 | medium | 4.3 | 2% |
| CVE-2014-9036 | WordPress core | Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remo | medium | 4.3 | 2% |
| CVE-2022-0710 | header-footer-code-manager (WordPress plugin) | The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page' | medium | 6.1 | 2% |
| CVE-2011-4595 | prettylinks (WordPress plugin) | Pretty-Link WordPress plugin 1.5.2 has XSS | medium | 6.1 | 2% |
| CVE-2015-3647 | wp-photo-album-plus (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for Wor | medium | 4.3 | 2% |
| CVE-2012-1834 | cms-tree-page-view (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 f | medium | 4.3 | 2% |
| CVE-2013-7341 | moodle/moodle, typo3/cms | Moodle cross-site scripting (XSS) vulnerabilities | medium | 0.0 | 2% |
| CVE-2017-11503 | phpmailer/phpmailer | Cross-site scripting in PHPMailer | medium | 6.1 | 2% |
| CVE-2022-28221 | antispam (WordPress plugin) | The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] paramet | medium | 6.1 | 2% |
| CVE-2015-6805 | mdc-private-message (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject a | low | 3.5 | 2% |