Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10471 | everest-forms (WordPress plugin) | The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-10510 | adbuddy\+-\(adblocker-detection\) (WordPress plugin) | The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which | medium | 4.8 | 0% |
| CVE-2024-10704 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-13121 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 | low | 3.5 | 0% |
| CVE-2025-5420 | juzaweb/cms | juzaweb CMS allows cross-site scripting by uploading an SVG file | low | 3.5 | 0% |
| CVE-2024-2087 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, a | high | 7.2 | 0% |
| CVE-2023-5230 | tm-woocommerce-compare-wishlist (WordPress plugin) | The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcod | medium | 6.4 | 0% |
| CVE-2024-11746 | gs-woo-brands (WordPress plugin) | The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stor | medium | 6.4 | 0% |
| CVE-2024-13575 | web-stories-enhancer (WordPress plugin) | The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'web | medium | 6.4 | 0% |
| CVE-2024-13591 | team-builder-for-wpbakery-page-builder (WordPress plugin) | The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | medium | 6.4 | 0% |
| CVE-2025-46734 | league/commonmark | league/commonmark contains a XSS vulnerability in Attributes extension | medium | 6.4 | 0% |
| CVE-2024-12290 | infility-global (WordPress plugin) | The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_type’ parameter in all versions up to, | medium | 6.1 | 0% |
| CVE-2023-2343 | pimcore/pimcore | Cross-site Scripting (XSS) in DataObject Classification Store | medium | 5.4 | 0% |
| CVE-2024-4483 | email-encoder (WordPress plugin) | The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outpu | medium | 5.4 | 0% |
| CVE-2024-12717 | infeed (WordPress plugin) | The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2023-4021 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in vers | medium | 4.4 | 0% |
| CVE-2019-7873 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.3 | 0% |
| CVE-2025-53370 | starcitizentools/citizen-skin | Citizen vulnerable to Stored XSS through short descriptions | high | 8.6 | 0% |
| CVE-2024-4869 | gdpr-cookie-consent (WordPress plugin) | The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ he | high | 7.2 | 0% |
| CVE-2023-35090 | masterstudy-lms (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses | medium | 6.5 | 0% |
| CVE-2023-47835 | ari-stream-quiz (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Q | medium | 6.5 | 0% |
| CVE-2024-3587 | auxin-portfolio (WordPress plugin) | The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portf | medium | 6.4 | 0% |
| CVE-2023-6882 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versi | medium | 6.1 | 0% |
| CVE-2024-10104 | jobs-for-wordpress (WordPress plugin) | The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users suc | medium | 5.9 | 0% |
| CVE-2024-6025 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow co | medium | 5.4 | 0% |
| CVE-2024-8239 | starbox (WordPress plugin) | The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user' | medium | 5.4 | 0% |
| CVE-2024-8536 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2024-13274 | goalgorilla/open_social | Drupal Open Social allows Functionality Misuse | medium | 5.3 | 0% |
| CVE-2024-2619 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insu | medium | 5.0 | 0% |
| CVE-2023-5124 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious J | medium | 4.8 | 0% |
| CVE-2024-9638 | category-posts-widget (WordPress plugin) | The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2023-1470 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versi | medium | 4.4 | 0% |
| CVE-2023-1913 | google-maps-widget (WordPress plugin) | The Maps Widget for Google Maps for WordPress is vulnerable to Stored Cross-Site Scripting via widget settings in versions up to, and includ | medium | 4.4 | 0% |
| CVE-2024-6792 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page. | low | 3.5 | 0% |
| CVE-2024-6692 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to | low | 3.3 | 0% |
| CVE-2024-10181 | newsletters-lite (WordPress plugin) | The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-1384 | auxin-portfolio (WordPress plugin) | The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_recen | medium | 6.4 | 0% |
| CVE-2024-5530 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-5879 | leadin (WordPress plugin) | The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' | medium | 6.4 | 0% |
| CVE-2022-36796 | callrail-phone-call-tracking (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking | medium | 6.1 | 0% |
| CVE-2023-2767 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settin | medium | 4.4 | 0% |
| CVE-2024-24881 | wp-sms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS No | high | 7.1 | 0% |
| CVE-2024-1239 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all | medium | 6.4 | 0% |
| CVE-2024-1366 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘archive_title_tag’ attribute of th | medium | 6.4 | 0% |
| CVE-2024-8364 | wp-custom-fields-search (WordPress plugin) | The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all | medium | 6.4 | 0% |
| CVE-2024-13629 | pushbiz (WordPress plugin) | The pushBIZ WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | medium | 6.1 | 0% |
| CVE-2024-13669 | calendapp (WordPress plugin) | The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 6.1 | 0% |
| CVE-2024-51434 | froala/wysiwyg-editor | Froala WYSIWYG editor allows cross-site scripting (XSS) | medium | 6.1 | 0% |
| CVE-2024-7691 | flaming-forms (WordPress plugin) | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to pe | medium | 6.1 | 0% |
| CVE-2024-7761 | simple-job-board (WordPress plugin) | In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored | medium | 6.1 | 0% |