Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4439 | WordPress core | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due t | high | 7.2 | 71% |
| CVE-2021-39348 | learnpress (WordPress plugin) | The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter f | medium | 5.5 | 5% |
| CVE-2020-4047 | WordPress core | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media | medium | 6.8 | 3% |
| CVE-2020-4049 | WordPress core | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript | low | 2.4 | 3% |
| CVE-2020-4046 | WordPress core | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inj | medium | 5.4 | 2% |
| CVE-2021-41129 | pterodactyl/panel | Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification | high | 8.1 | 2% |
| CVE-2022-1801 | very-simple-contact-form (WordPress plugin) | The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden i | high | 7.5 | 1% |
| CVE-2022-0989 | ns-watermark-for-woocommerce (WordPress plugin) | An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide ma | high | 7.5 | 1% |
| CVE-2022-24749 | sylius/sylius | Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius | medium | 6.1 | 1% |
| CVE-2024-34070 | froxlor/froxlor | Blind XSS Leading to Froxlor Application Compromise | critical | 9.6 | 1% |
| CVE-2024-24574 | phpmyfaq/phpmyfaq | phpMyFAQ vulnerable to stored XSS on attachments filename | medium | 6.5 | 1% |
| CVE-2021-41258 | getkirby/cms | Cross-site scripting (XSS) from image block content in the site frontend | medium | 5.4 | 1% |
| CVE-2024-24570 | statamic/cms | Statmic CMS vulnerable to account takeover via XSS and password reset link | high | 8.2 | 1% |
| CVE-2023-33197 | craftcms/cms | Craft CMS stored XSS in indexedVolumes | medium | 5.5 | 1% |
| CVE-2026-52774 | yeswiki/yeswiki | YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes | medium | 6.1 | 1% |
| CVE-2023-33196 | craftcms/cms | Craft CMS stored XSS in review volume | medium | 5.5 | 1% |
| CVE-2021-27915 | mautic/core | Mautic vulnerable to stored cross-site scripting in description field | high | 7.6 | 1% |
| CVE-2023-33194 | craftcms/cms | CraftCMS stored XSS in Quick Post widget error message | low | 3.7 | 1% |
| CVE-2026-52773 | yeswiki/yeswiki | YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` | medium | 6.1 | 1% |
| CVE-2024-32489 | tecnickcom/tcpdf | TCPDF Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2026-52854 | mediawiki/maps | mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function | high | 8.6 | 1% |
| CVE-2024-23817 | dolibarr/dolibarr | Dolibarr Application Home Page has HTML injection vulnerability | high | 7.1 | 1% |
| CVE-2024-28108 | phpmyfaq/phpmyfaq | phpMyFAQ Stored HTML Injection at contentLink | medium | 5.1 | 1% |
| CVE-2021-32735 | getkirby/cms | Cross-site scripting (XSS) from field and configuration text displayed in the Panel | high | 7.1 | 1% |
| CVE-2023-6963 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it po | medium | 5.3 | 1% |
| CVE-2024-8680 | mailchimp-for-wp (WordPress plugin) | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up t | medium | 4.4 | 1% |
| CVE-2024-24807 | sulu/sulu | Sulu HTML Injection via Autocomplete Suggestion | low | 0.0 | 1% |
| CVE-2026-55690 | starcitizenwiki/embedvideo | StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text | high | 7.5 | 0% |
| CVE-2026-55692 | starcitizenwiki/embedvideo | StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled | high | 7.5 | 0% |
| CVE-2026-55691 | starcitizenwiki/embedvideo | StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template | high | 8.6 | 0% |
| CVE-2024-37297 | woocommerce (WordPress plugin), woocommerce/woocommerce | WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site sc | medium | 5.4 | 0% |
| CVE-2022-4036 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to t | medium | 5.3 | 0% |
| CVE-2024-47536 | starcitizentools/citizen-skin | starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field | medium | 4.6 | 0% |
| CVE-2024-8872 | order-hours-scheduler-for-woocommerce (WordPress plugin) | The Store Hours for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without | medium | 6.1 | 0% |
| CVE-2024-56199 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ Vulnerable to Stored HTML Injection at FAQ | medium | 5.2 | 0% |
| CVE-2025-53093 | starcitizentools/tabber-neue | TabberNeue vulnerable to Stored XSS through wikitext | high | 8.6 | 0% |
| CVE-2022-25774 | mautic/core | Mautic vulnerable to cross-site scripting in notifications via saving Dashboards | medium | 4.8 | 0% |
| CVE-2024-47765 | dev-lancer/minecraft-motd-parser | Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS | medium | 6.1 | 0% |
| CVE-2026-55696 | privatebin/privatebin | PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-inter | medium | 4.3 | 0% |
| CVE-2024-45406 | craftcms/cms | Craft CMS vulnerable to stored XSS in breadcrumb list and title fields | medium | 5.5 | 0% |
| CVE-2024-13704 | super-testimonial (WordPress plugin) | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions u | high | 7.2 | 0% |
| CVE-2025-1262 | advanced-google-recaptcha (WordPress plugin) | The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it po | medium | 5.3 | 0% |
| CVE-2025-48958 | froxlor/froxlor | Froxlor has an HTML Injection Vulnerability | medium | 5.5 | 0% |
| CVE-2025-28254 | leantime/leantime | Leantime affected by Improper Neutralization of HTML Tags | medium | 6.5 | 0% |
| CVE-2026-57440 | starcitizenwiki/embedvideo | Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled | high | 7.5 | 0% |
| CVE-2024-13497 | tripetto (WordPress plugin) | The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site | high | 7.2 | 0% |
| CVE-2026-4267 | johnbillion/query-monitor | The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI | medium | 6.1 | 0% |
| CVE-2026-33080 | filament/tables | Filament Unvalidated Range and Values summarizer values can be used for XSS | high | 7.3 | 0% |
| CVE-2024-37156 | sulu/form-bundle | TokenController formName not sanitized in hidden input | medium | 6.1 | 0% |
| CVE-2025-62414 | bagisto/bagisto | bagisto has Cross Site Scripting (XSS) in Create New Customer | medium | 6.9 | 0% |