Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-22721 | oi-yandex.maps (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress <= 3.2.7 versions. | medium | 6.5 | 0% |
| CVE-2023-23977 | social-comments (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments | medium | 6.5 | 0% |
| CVE-2023-36503 | maxbuttons (WordPress plugin) | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions. | medium | 6.5 | 0% |
| CVE-2024-8547 | simple-popup-plugin (WordPress plugin) | The Simple Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [popup] shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-13678 | r3w-instafeed (WordPress plugin) | The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 0% |
| CVE-2023-5873 | pimcore/pimcore | Pimcore Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2026-54458 | wwbn/avideo | WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin | critical | 9.6 | 0% |
| CVE-2026-32257 | winter/wn-backend-module | Winter: Stored XSS through Brand Settings custom styles | high | 8.1 | 0% |
| CVE-2026-32258 | winter/wn-backend-module | Winter: Stored XSS through Editor Settings custom styles | high | 8.1 | 0% |
| CVE-2026-84189 | librenms/librenms | LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page | high | 8.1 | 0% |
| CVE-2025-0916 | yaysmtp (WordPress plugin) | The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to | high | 7.2 | 0% |
| CVE-2022-47146 | real-estate-7 (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions. | high | 7.1 | 0% |
| CVE-2023-24413 | wordpress-vertical-image-slider (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress vertical image slider plugin <= 1.2.16 versi | high | 7.1 | 0% |
| CVE-2023-28781 | wordpress-contact-forms (WordPress plugin) | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions. | high | 7.1 | 0% |
| CVE-2023-28789 | wordpress-contact-forms (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions | high | 7.1 | 0% |
| CVE-2023-30498 | vimeotheque (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeFlavors Vimeotheque: Vimeo WordPress Plugin <= 2.2.1 versions. | high | 7.1 | 0% |
| CVE-2023-32499 | radio-station (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tony Zeoli, Tony Hayes Radio Station by netmix® – Manage and play your Show Sc | high | 7.1 | 0% |
| CVE-2023-32503 | gtmetrix (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.6 versions. | high | 7.1 | 0% |
| CVE-2023-37977 | wpfunnels (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plug | high | 7.1 | 0% |
| CVE-2024-8108 | share-this-image (WordPress plugin) | The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' parameter in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-4860 | rss-aggregator (WordPress plugin) | The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lac | medium | 5.4 | 0% |
| CVE-2023-6957 | fluentform (WordPress plugin) | The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up t | medium | 4.9 | 0% |
| CVE-2024-5883 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, | medium | 4.7 | 0% |
| CVE-2023-4726 | ultimate-dashboard (WordPress plugin) | The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including | medium | 4.4 | 0% |
| CVE-2024-3600 | poll-maker (WordPress plugin) | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability ch | high | 7.2 | 0% |
| CVE-2024-13632 | wp-extra-fields (WordPress plugin) | The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t | high | 7.1 | 0% |
| CVE-2024-13633 | simple-catalogue (WordPress plugin) | The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 0% |
| CVE-2024-1159 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, | medium | 6.4 | 0% |
| CVE-2023-42817 | pimcore/admin-ui-classic-bundle | pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations | medium | 5.4 | 0% |
| CVE-2024-10473 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the | medium | 5.4 | 0% |
| CVE-2024-1160 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, an | medium | 5.4 | 0% |
| CVE-2024-41816 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[co | medium | 5.4 | 0% |
| CVE-2024-0630 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the RSS feed source in all versions up to, and i | medium | 4.4 | 0% |
| CVE-2024-11974 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit- | medium | 6.1 | 0% |
| CVE-2024-13603 | wise-forms (WordPress plugin) | The Wise Forms WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow unauthenticated users to | medium | 6.1 | 0% |
| CVE-2024-2119 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions u | medium | 6.1 | 0% |
| CVE-2024-5626 | inline-related-posts (WordPress plugin) | The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leadi | medium | 6.1 | 0% |
| CVE-2024-8664 | wp-test-email (WordPress plugin) | The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate e | medium | 6.1 | 0% |
| CVE-2024-9205 | maximum-products-per-user-for-woocommerce (WordPress plugin) | The Maximum Products per User for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_que | medium | 6.1 | 0% |
| CVE-2023-23878 | wp-maps (WordPress plugin) | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS plugin <= 4.3.9 ve | medium | 5.9 | 0% |
| CVE-2023-36259 | superbig/craft-audit | Craft CMS Audit Plugin Cross Site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-7089 | easy-svg-support (WordPress plugin) | The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author t | medium | 5.4 | 0% |
| CVE-2024-9881 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2023-5121 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup pa | medium | 4.4 | 0% |
| CVE-2024-1041 | wp-radio (WordPress plugin) | The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-13732 | responsive-block-editor-addons (WordPress plugin) | The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘section_tag’ p | medium | 6.4 | 0% |
| CVE-2024-1658 | grid-shortcodes (WordPress plugin) | The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2025-67855 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2023-5980 | bsk-forms-blacklist (WordPress plugin) | The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2024-0951 | advanced-social-feeds-widget-\&-shortcode (WordPress plugin) | The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could all | medium | 4.8 | 0% |