Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9209 | search-analytics (WordPress plugin) | The WP Search Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropr | medium | 6.1 | 0% |
| CVE-2024-9220 | lh-copy-media-file (WordPress plugin) | The LH Copy Media File plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropri | medium | 6.1 | 0% |
| CVE-2024-9228 | loggedin (WordPress plugin) | The Loggedin – Limit Active Logins plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with | medium | 6.1 | 0% |
| CVE-2024-9385 | themify-builder (WordPress plugin) | The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-9865 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking | medium | 6.1 | 0% |
| CVE-2023-23734 | userlike (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Voswinkel Userlike – WordPress Live Chat plugin <= 2.2 versions. | medium | 5.9 | 0% |
| CVE-2023-25972 | wordpress-ctapt (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in IKSWEB WordPress Старт plugin <= 3.7 versions. | medium | 5.9 | 0% |
| CVE-2024-8619 | ajax-search (WordPress plugin) | The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2025-1319 | site-mailer (WordPress plugin) | The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting i | high | 7.2 | 0% |
| CVE-2024-4333 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-2189 | social-icons-widget (WordPress plugin) | The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which cou | medium | 6.1 | 0% |
| CVE-2024-6020 | sign-up-sheets (WordPress plugin) | The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER['REQUEST_URI'] parameter befo | medium | 6.1 | 0% |
| CVE-2024-4627 | seo (WordPress plugin) | The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to | medium | 5.4 | 0% |
| CVE-2024-6408 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users su | medium | 5.4 | 0% |
| CVE-2024-6884 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before out | medium | 5.4 | 0% |
| CVE-2024-21517 | opencart/opencart | Cross site scripting in opencart | medium | 4.2 | 0% |
| CVE-2024-13314 | carousel\,-slider\,-gallery-by-wp-carousel (WordPress plugin) | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could a | low | 3.5 | 0% |
| CVE-2023-4995 | embed-calendly-scheduling (WordPress plugin) | The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and includi | medium | 6.4 | 0% |
| CVE-2023-5001 | horizontal-scrolling-announcement (WordPress plugin) | The Horizontal scrolling announcement plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'horizontal-scrolling' shortcode | medium | 6.4 | 0% |
| CVE-2023-5668 | whatsapp (WordPress plugin) | The WhatsApp Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'whatsapp' shortcode in all ver | medium | 6.4 | 0% |
| CVE-2024-4711 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajax_load_more shor | medium | 6.4 | 0% |
| CVE-2023-6541 | allow-svg (WordPress plugin) | The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to up | medium | 6.1 | 0% |
| CVE-2023-7230 | illi-link-party\! (WordPress plugin) | The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low a | medium | 6.1 | 0% |
| CVE-2024-45967 | pagekit/pagekit | Pagekit Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2023-6081 | chartjs (WordPress plugin) | The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 5.4 | 0% |
| CVE-2023-6082 | chartjs (WordPress plugin) | The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 5.4 | 0% |
| CVE-2024-1157 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, a | medium | 5.4 | 0% |
| CVE-2024-56412 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters | medium | 5.4 | 0% |
| CVE-2024-5578 | table-of-contents-plus (WordPress plugin) | The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-7876 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape | medium | 4.8 | 0% |
| CVE-2024-7877 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape | medium | 4.8 | 0% |
| CVE-2024-9883 | pods (WordPress plugin) | The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-2744 | nextgen-gallery (WordPress plugin) | The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.3 | 0% |
| CVE-2026-75828 | getgrav/grav | Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS | high | 8.7 | 0% |
| CVE-2025-13206 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ param | high | 7.2 | 0% |
| CVE-2023-6830 | formidable (WordPress plugin) | The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows u | medium | 6.5 | 0% |
| CVE-2023-6500 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2024-1291 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown URL parameter in all versions u | medium | 6.4 | 0% |
| CVE-2024-1762 | social-networks-auto-poster-facebook-twitter-g (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP_USER_AGENT heade | medium | 6.1 | 0% |
| CVE-2024-3580 | popup4phone (WordPress plugin) | The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 6.1 | 0% |
| CVE-2024-47765 | dev-lancer/minecraft-motd-parser | Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS | medium | 6.1 | 0% |
| CVE-2024-21628 | prestashop/prestashop | PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO) | medium | 5.4 | 0% |
| CVE-2023-0710 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_tha | medium | 4.9 | 0% |
| CVE-2023-6953 | fluentforms-pdf (WordPress plugin) | The PDF Generator For Fluent Forms – The Contact Form Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the heade | medium | 4.9 | 0% |
| CVE-2023-5529 | advanced-page-visit-counter (WordPress plugin) | The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2023-5932 | travelpayouts (WordPress plugin) | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting | medium | 4.8 | 0% |
| CVE-2024-7084 | ajax-search (WordPress plugin) | The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low | medium | 4.8 | 0% |
| CVE-2026-86431 | league/commonmark | league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed | high | 7.2 | 0% |
| CVE-2024-4290 | sailthru-triggermail (WordPress plugin) | The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege us | high | 7.1 | 0% |
| CVE-2023-5317 | thorsten/phpmyfaq | phpMyFaq Cross-site Scripting vulnerability | medium | 6.3 | 0% |