Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-27860 | footer-text (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress. | medium | 6.1 | 0% |
| CVE-2022-4954 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to | medium | 5.5 | 0% |
| CVE-2022-29413 | hermit (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &ti | medium | 4.7 | 0% |
| CVE-2022-29436 | code-snippets-extended (WordPress plugin) | Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Si | medium | 4.7 | 0% |
| CVE-2024-35498 | getgrav/grav | Grav Cross-site Scripting vulnerability | low | 0.0 | 0% |
| CVE-2026-34560 | ci4-cms-erp/ci4ms | CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2024-5151 | sully (WordPress plugin) | The SULly WordPress plugin before 4.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | high | 7.1 | 0% |
| CVE-2024-5715 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | high | 7.1 | 0% |
| CVE-2024-3208 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versi | medium | 6.4 | 0% |
| CVE-2024-4709 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 6.4 | 0% |
| CVE-2024-8189 | wp-multitasking (WordPress plugin) | The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in a | medium | 4.4 | 0% |
| CVE-2022-44743 | jobs-for-wordpress (WordPress plugin) | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.11.2 versions. | medium | 6.5 | 0% |
| CVE-2024-13403 | wpforms-lite (WordPress plugin) | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 0% |
| CVE-2024-3641 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors t | medium | 6.1 | 0% |
| CVE-2024-5613 | formula (WordPress theme) | The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dis | medium | 6.1 | 0% |
| CVE-2024-5638 | formula (WordPress theme) | The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ti_customizer_notify_dismiss_ | medium | 6.1 | 0% |
| CVE-2024-8712 | gtm-server-side (WordPress plugin) | The GTM Server Side plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-8741 | beam-me-up-scotty (WordPress plugin) | The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_ | medium | 6.1 | 0% |
| CVE-2024-8800 | rabbit-loader (WordPress plugin) | The RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more plugin for WordP | medium | 6.1 | 0% |
| CVE-2024-9210 | mailchimp-top-bar (WordPress plugin) | The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without ap | medium | 6.1 | 0% |
| CVE-2024-9218 | magazine-blocks (WordPress plugin) | The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is | medium | 6.1 | 0% |
| CVE-2024-9222 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to R | medium | 6.1 | 0% |
| CVE-2024-9345 | product-delivery-date-for-woocommerce-lite (WordPress plugin) | The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_ | medium | 6.1 | 0% |
| CVE-2024-9353 | popularis-extra (WordPress plugin) | The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg | medium | 6.1 | 0% |
| CVE-2024-9384 | wholesale-pricing-woocommerce (WordPress plugin) | The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to th | medium | 6.1 | 0% |
| CVE-2024-9435 | shiftcontroller (WordPress plugin) | The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL keys in all versi | medium | 6.1 | 0% |
| CVE-2024-9613 | formfacade (WordPress plugin) | The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and | medium | 6.1 | 0% |
| CVE-2023-49841 | optin-forms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Optin Forms – Simple List | medium | 5.9 | 0% |
| CVE-2021-24618 | donate-with-qrcode (WordPress plugin) | The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross- | medium | 5.4 | 0% |
| CVE-2025-55742 | unopim/unopim | UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality | medium | 6.8 | 0% |
| CVE-2023-49168 | better-messages (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages – Live Chat f | medium | 6.5 | 0% |
| CVE-2024-2484 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Services and Post Type Grid widgets in | medium | 6.4 | 0% |
| CVE-2024-4567 | themify-shortcodes (WordPress plugin) | The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themify_button shortcode in all ve | medium | 6.4 | 0% |
| CVE-2024-5582 | schema-and-structured-data-for-wp (WordPress plugin) | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute | medium | 6.4 | 0% |
| CVE-2024-5763 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-6208 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-6804 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-7302 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads | medium | 6.4 | 0% |
| CVE-2024-7304 | ninja-tables (WordPress plugin) | The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all | medium | 6.4 | 0% |
| CVE-2024-7317 | folders (WordPress plugin) | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cr | medium | 6.4 | 0% |
| CVE-2024-8440 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-8486 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter | medium | 6.4 | 0% |
| CVE-2024-8505 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ para | medium | 6.4 | 0% |
| CVE-2024-2833 | job-postings (WordPress plugin) | The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions u | medium | 6.1 | 0% |
| CVE-2024-3615 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, | medium | 6.1 | 0% |
| CVE-2024-39318 | ibexa/admin-ui | Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget | medium | 5.4 | 0% |
| CVE-2024-3994 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tut | medium | 5.4 | 0% |
| CVE-2026-47743 | shopper/framework | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | high | 8.7 | 0% |
| CVE-2023-4779 | user-submitted-posts (WordPress plugin) | The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versi | medium | 6.4 | 0% |
| CVE-2023-30124 | lavalite/cms | LavaLite vulnerable to Cross Site Scripting | medium | 5.4 | 0% |