Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-11023 KEV | components/jquery | Potential XSS vulnerability in jQuery | medium | 6.9 | 85% |
| CVE-2019-9978 KEV | social-warfare (WordPress plugin), social-warfare-pro (WordPress plugin) | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter | medium | 6.1 | 73% |
| CVE-2020-11022 | athlon1600/youtube-downloader, components/jquery, maximebf/debugbar | Potential XSS vulnerability in jQuery | medium | 6.9 | 99% |
| CVE-2022-3562 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 5.4 | 94% |
| CVE-2022-4067 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 5.4 | 94% |
| CVE-2022-4069 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 4.8 | 93% |
| CVE-2023-0992 | wp-simple-firewall (WordPress plugin) | The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'Use | high | 7.2 | 93% |
| CVE-2022-1707 | google-tag-manager (WordPress plugin) | The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the sit | medium | 6.1 | 89% |
| CVE-2019-11358 | maximebf/debugbar, drupal/core | XSS in jQuery as used in Drupal, Backdrop CMS, and other products | medium | 6.1 | 87% |
| CVE-2018-10095 | dolibarr/dolibarr | Dolibarr Cross-site scripting (XSS) vulnerability | medium | 6.1 | 87% |
| CVE-2021-21029 | magento/community-edition | Magento Reflected Cross-site Scripting vulnerability via 'file' parameter | medium | 4.8 | 85% |
| CVE-2023-3388 | beautiful-and-responsive-cookie-consent (WordPress plugin) | The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in v | high | 7.2 | 84% |
| CVE-2021-25080 | contact-form-entries (WordPress plugin) | The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as C | medium | 6.1 | 84% |
| CVE-2022-28368 | dompdf/dompdf | Remote code injection in dompdf/dompdf | critical | 9.8 | 84% |
| CVE-2021-23174 | download-monitor (WordPress plugin) | Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4. | low | 3.4 | 84% |
| CVE-2022-2753 | ketchup-restaurant-reservations (WordPress plugin) | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowin | medium | 6.1 | 84% |
| CVE-2019-14470 | cosenary/instagram, user-pro (WordPress plugin) | Cosenary Instagram-PHP-API contains reflected XSS vulnerability | medium | 6.1 | 83% |
| CVE-2021-33618 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 79% |
| CVE-2022-25305 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter f | high | 7.2 | 79% |
| CVE-2024-49754 | librenms/librenms | LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php | high | 7.5 | 74% |
| CVE-2023-4347 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | high | 7.6 | 70% |
| CVE-2022-0364 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which coul | medium | 5.4 | 70% |
| CVE-2022-34258 | magento/community-edition | Magento stored Cross-Site Scripting (XSS) vulnerability | medium | 5.5 | 69% |
| CVE-2022-0832 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 67% |
| CVE-2022-0218 | wp-html-mail (WordPress plugin) | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme s | high | 8.3 | 66% |
| CVE-2022-4830 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 65% |
| CVE-2022-21662 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticate | high | 8.0 | 65% |
| CVE-2022-25772 | mautic/core | Cross-site Scripting vulnerability in Mautic's tracking pixel functionality | critical | 9.6 | 63% |
| CVE-2023-22249 | magento/community-edition | Magento Open Source allows Cross-Site Scripting (XSS) | medium | 4.8 | 58% |
| CVE-2017-7309 | mantisbt/mantisbt | MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php | medium | 4.8 | 57% |
| CVE-2024-34716 | prestashop/prestashop | PrestaShop cross-site scripting via customer contact form in FO, through file upload | critical | 9.6 | 56% |
| CVE-2022-1104 | popup-maker (WordPress plugin) | The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege use | medium | 4.8 | 56% |
| CVE-2021-28114 | froala/wysiwyg-editor | Cross-site Scripting in Froala WYSIWYG Editor | medium | 5.4 | 52% |
| CVE-2020-15299 | kingcomposer (WordPress plugin) | A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick | medium | 6.1 | 47% |
| CVE-2024-53457 | librenms/librenms | LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section | medium | 5.4 | 46% |
| CVE-2022-3062 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflect | medium | 6.1 | 44% |
| CVE-2023-0448 | wp-helper-premium (WordPress plugin) | The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cro | medium | 6.1 | 43% |
| CVE-2024-50352 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php | high | 7.5 | 41% |
| CVE-2021-32671 | flarum/core | XSS vulnerability with translator | critical | 10.0 | 40% |
| CVE-2022-4068 | librenms/librenms | Cross-site Scripting in librenms/librenms | high | 7.6 | 38% |
| CVE-2025-0370 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in | medium | 6.4 | 37% |
| CVE-2024-32479 | librenms/librenms | LibreNMS uses Improper Sanitization on Service template name leads to Stored XSS | high | 7.1 | 34% |
| CVE-2023-0157 | all-in-one-security (WordPress plugin) | The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin adm | medium | 4.8 | 32% |
| CVE-2025-23200 | librenms/librenms | LibreNMS Misc Section Stored Cross-site Scripting vulnerability | medium | 4.6 | 32% |
| CVE-2024-47525 | librenms/librenms | LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature | high | 7.5 | 30% |
| CVE-2021-24891 | website-builder (WordPress plugin) | The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, | medium | 6.1 | 29% |
| CVE-2023-1861 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboa | medium | 5.4 | 29% |
| CVE-2023-0084 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in vers | high | 7.2 | 29% |
| CVE-2024-2123 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | high | 7.2 | 27% |
| CVE-2021-24563 | frontend-uploader (WordPress plugin) | The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated | medium | 6.1 | 26% |