Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0928 | microweber/microweber | Cross-site Scripting in microweber | medium | 6.8 | 2% |
| CVE-2014-7138 | google-calendar-events (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject a | medium | 4.3 | 2% |
| CVE-2014-2853 | mediawiki/core | Cross-site scripting vulnerability in includes/actions/InfoAction.php | medium | 0.0 | 2% |
| CVE-2015-3397 | yiisoft/yii2, yiisoft/yii2-bootstrap, yiisoft/yii2-dev +2 more | Yii Framework Cross-site Scripting Vulnerability | medium | 0.0 | 2% |
| CVE-2014-6315 | photo-gallery-plugin (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote att | medium | 4.3 | 2% |
| CVE-2007-4139 | WordPress core | Cross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, a | medium | 4.3 | 2% |
| CVE-2021-24664 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not es | medium | 4.8 | 2% |
| CVE-2018-7198 | rainlab/blog-plugin | October CMS - RainLab Blog Plugin XSS | medium | 6.1 | 2% |
| CVE-2021-39322 | easy-social-icons (WordPress plugin) | The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configur | medium | 6.1 | 2% |
| CVE-2015-1204 | wp-slimstat (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remot | medium | 4.3 | 2% |
| CVE-2022-0149 | woocommerce-exporter (WordPress plugin) | The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the wo | medium | 6.1 | 2% |
| CVE-2015-7989 | WordPress core | Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitr | medium | 5.4 | 2% |
| CVE-2022-0653 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient esca | medium | 6.1 | 2% |
| CVE-2015-1394 | photo-gallery (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users | medium | 5.4 | 2% |
| CVE-2021-45416 | francoisjacquet/rosariosis | RosarioSIS XSS Vulnerability | medium | 0.0 | 2% |
| CVE-2021-39320 | underconstruction (WordPress plugin) | The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain | medium | 6.1 | 2% |
| CVE-2008-0617 | dmsguestbook (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.7.0 plugin for WordPress allow remote attackers to inject arbitrar | medium | 4.3 | 2% |
| CVE-2021-24444 | taxopress (WordPress plugin) | The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description fi | medium | 4.8 | 2% |
| CVE-2013-4752 | symfony/http-foundation, symfony/symfony | Symfony Host Header Injection vulnerability in the HttpFoundation component | medium | 6.1 | 2% |
| CVE-2021-34640 | securimage-wp-fixed (WordPress plugin) | The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/sec | medium | 6.1 | 2% |
| CVE-2021-20717 | ec-cube/ec-cube | EC-CUBE Cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2017-14126 | participants-database (WordPress plugin) | The Participants Database plugin before 1.7.5.10 for WordPress has XSS. | medium | 6.1 | 2% |
| CVE-2022-0212 | spidercalendar (WordPress plugin) | The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page | medium | 6.1 | 2% |
| CVE-2021-25078 | affiliates-manager (WordPress plugin) | The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click t | medium | 6.1 | 2% |
| CVE-2022-0678 | microweber/microweber | Cross-site Scripting in microweber | medium | 6.5 | 2% |
| CVE-2011-3841 | wp-symposium (WordPress plugin) | Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows | medium | 4.3 | 2% |
| CVE-2014-4664 | wordfence (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbit | medium | 4.3 | 2% |
| CVE-2021-25008 | code-snippets (WordPress plugin) | The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, l | medium | 6.1 | 2% |
| CVE-2021-39350 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/v | medium | 6.1 | 2% |
| CVE-2021-24746 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes | medium | 6.1 | 2% |
| CVE-2018-19970 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 2% |
| CVE-2015-1385 | powerpress (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to i | medium | 4.3 | 2% |
| CVE-2022-23988 | ws-form (WordPress plugin) | The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker | medium | 6.1 | 2% |
| CVE-2020-35296 | zoujingli/thinkadmin | ThinkAdmin Admin Panel Access using Default Credentials | high | 7.5 | 2% |
| CVE-2022-0189 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX ac | medium | 6.1 | 2% |
| CVE-2010-2230 | moodle/moodle | Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter | medium | 0.0 | 2% |
| CVE-2019-17233 | ultimate-faqs (WordPress plugin) | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. | medium | 6.1 | 2% |
| CVE-2019-3847 | moodle/moodle | Moodle XSS Vulnerability | medium | 4.8 | 2% |
| CVE-2007-5106 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML | medium | 4.3 | 2% |
| CVE-2022-42096 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 2% |
| CVE-2022-42095 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 2% |
| CVE-2019-16222 | WordPress core | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site s | medium | 6.1 | 2% |
| CVE-2014-5240 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote au | low | 2.1 | 2% |
| CVE-2020-7107 | ultimate-faqs (WordPress plugin) | The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php. | medium | 6.1 | 2% |
| CVE-2021-25112 | whmcs-bridge (WordPress plugin) | The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, | medium | 6.1 | 2% |
| CVE-2016-5733 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-site Scripting | medium | 6.1 | 2% |
| CVE-2019-15713 | my-calendar (WordPress plugin) | The my-calendar plugin before 3.1.10 for WordPress has XSS. | medium | 6.1 | 2% |
| CVE-2016-1000144 | photoxhibit (WordPress plugin) | Reflected XSS in wordpress plugin photoxhibit v2.1.8 | medium | 6.1 | 2% |
| CVE-2016-1000145 | pondol-carousel (WordPress plugin) | Reflected XSS in wordpress plugin pondol-carousel v1.0 | medium | 6.1 | 2% |
| CVE-2016-1000147 | recipes-writer (WordPress plugin) | Reflected XSS in wordpress plugin recipes-writer v1.0.4 | medium | 6.1 | 2% |