Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4272 | support-svg (WordPress plugin) | The Support SVG WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG | medium | 6.1 | 0% |
| CVE-2025-22131 | phpoffice/phpexcel, phpoffice/phpspreadsheet | Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet | medium | 6.1 | 0% |
| CVE-2023-27618 | store-locator (WordPress plugin) | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in AGILELOGIX Store Locator WordPress plugin <= 1.4.9 versions. | medium | 5.9 | 0% |
| CVE-2024-9940 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to | medium | 5.3 | 0% |
| CVE-2024-7878 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-8758 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | 0% |
| CVE-2025-2162 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-56144 | librenms/librenms | LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability | medium | 4.6 | 0% |
| CVE-2024-5902 | userfeedback-lite (WordPress plugin) | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross- | high | 7.2 | 0% |
| CVE-2023-7029 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in al | medium | 6.4 | 0% |
| CVE-2024-10113 | wpadcenter (WordPress plugin) | The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpadcenter_ad | medium | 6.4 | 0% |
| CVE-2024-9177 | themedy-toolbox (WordPress plugin) | The Themedy Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themedy_col, themedy_social_link, the | medium | 6.4 | 0% |
| CVE-2023-30177 | craftcms/cms | Cross Site Scripting in CraftCMS | medium | 6.1 | 0% |
| CVE-2024-10265 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Script | medium | 6.1 | 0% |
| CVE-2024-12714 | backlink-monitoring-manager (WordPress plugin) | The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 0% |
| CVE-2024-12715 | asgard-security-scanner (WordPress plugin) | The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.1 | 0% |
| CVE-2024-47817 | lara-zeus/artemis, lara-zeus/dynamic-dashboard | Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS | medium | 6.1 | 0% |
| CVE-2024-5730 | pagerank-tools (WordPress plugin) | The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-8787 | clover-online-orders (WordPress plugin) | The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & rem | medium | 6.1 | 0% |
| CVE-2024-9237 | fish-and-ships (WordPress plugin) | The Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate plugin for WordPress is vulnerable to Reflected Cross-Si | medium | 6.1 | 0% |
| CVE-2021-24615 | wechat-reward (WordPress plugin) | The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attack | medium | 5.4 | 0% |
| CVE-2024-10482 | media-library-tools (WordPress plugin) | The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded | medium | 5.4 | 0% |
| CVE-2024-13688 | admin-and-site-enhancements (WordPress plugin) | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing | medium | 5.3 | 0% |
| CVE-2022-25774 | mautic/core | Mautic vulnerable to cross-site scripting in notifications via saving Dashboards | medium | 4.8 | 0% |
| CVE-2023-6164 | mainwp (WordPress plugin) | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘new | low | 2.2 | 0% |
| CVE-2023-4887 | intergeo-maps (WordPress plugin) | The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up | medium | 6.4 | 0% |
| CVE-2023-5231 | magic-action-box (WordPress plugin) | The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17 | medium | 6.4 | 0% |
| CVE-2023-5334 | responsive-header-image-slider (WordPress plugin) | The WP Responsive header image slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sp_responsiveslider' shortcode | medium | 6.4 | 0% |
| CVE-2023-5337 | formforall (WordPress plugin) | The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to | medium | 6.4 | 0% |
| CVE-2023-5468 | slick-contact-forms (WordPress plugin) | The Slick Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcscf-link' shortcode in versions up to, and | medium | 6.4 | 0% |
| CVE-2025-52277 | yeswiki/yeswiki | YesWiki Cross Site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2023-25049 | ecommerce-product-catalog (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.4 v | medium | 5.9 | 0% |
| CVE-2023-47833 | theater-for-wordpress (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress pl | medium | 5.9 | 0% |
| CVE-2024-2640 | watu-quiz (WordPress plugin) | The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if | medium | 5.4 | 0% |
| CVE-2024-5416 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url | medium | 5.4 | 0% |
| CVE-2024-2972 | floating-chat-widget (WordPress plugin) | The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin bef | low | 3.8 | 0% |
| CVE-2024-10710 | yadisk-files (WordPress plugin) | The YaDisk Files WordPress plugin through 1.2.5 does not sanitise and escape some of its settings, which could allow high privilege users su | low | 3.5 | 0% |
| CVE-2023-49827 | soledad (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Ne | high | 7.1 | 0% |
| CVE-2023-24003 | wp-popups (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin <= 2.1.4.8 versions. | medium | 6.5 | 0% |
| CVE-2024-5036 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-5901 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up | medium | 6.4 | 0% |
| CVE-2023-28851 | andrewhaine/silverstripe-form-capture, bigfork/silverstripe-form-capture | Silverstripe Form Capture vulnerable to stored cross-site-scripting | medium | 6.1 | 0% |
| CVE-2024-6334 | easy-table-of-contents (WordPress plugin) | The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privil | medium | 6.1 | 0% |
| CVE-2023-28820 | concrete5/concrete5 | Stored cross site scripting in RSS displayer | low | 2.0 | 0% |
| CVE-2024-10483 | simplepress (WordPress plugin) | The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leadi | high | 7.1 | 0% |
| CVE-2024-10117 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-8668 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-8917 | football-leagues-by-anwppro (WordPress plugin) | The AnWP Football Leagues plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-8793 | woocommerce-exporter (WordPress plugin) | The Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin for WordPress is vulnerable to Re | medium | 6.1 | 0% |
| CVE-2024-8803 | bulk-noindex-nofollow-toolkit-by-mad-fish (WordPress plugin) | The Bulk NoIndex & NoFollow Toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg | medium | 6.1 | 0% |