Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8724 | waitlist-woocommerce (WordPress plugin) | The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of a | medium | 6.1 | 0% |
| CVE-2024-9344 | searchpro (WordPress plugin) | The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for Word | medium | 6.1 | 0% |
| CVE-2024-5442 | nextgen-gallery (WordPress plugin) | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could all | medium | 5.9 | 0% |
| CVE-2024-6026 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated | medium | 5.4 | 0% |
| CVE-2025-4955 | tarteaucitron.io (WordPress plugin) | The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correc | medium | 4.7 | 0% |
| CVE-2023-6828 | arforms-form-builder (WordPress plugin) | The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site S | high | 7.2 | 0% |
| CVE-2024-10260 | tripetto (WordPress plugin) | The Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 8.0.11 | high | 7.2 | 0% |
| CVE-2024-2082 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | high | 7.2 | 0% |
| CVE-2023-30485 | avartan-slider-lite (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Solwin Infotech Responsive WordPress Slider – Avartan Slider Lite plugin <= 1. | high | 7.1 | 0% |
| CVE-2023-34180 | free-google-fonts (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in KAPlugins Google Fonts For WordPress plugin <= 3.0.0 versions. | high | 7.1 | 0% |
| CVE-2023-39992 | online-booking-\&-scheduling-calendar (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita plugin < | high | 7.1 | 0% |
| CVE-2024-1320 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'offline_st | medium | 6.5 | 0% |
| CVE-2023-4482 | amazon-auto-links (WordPress plugin) | The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and inclu | medium | 6.4 | 0% |
| CVE-2023-5946 | digirisk (WordPress plugin) | The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 du | medium | 6.1 | 0% |
| CVE-2023-6527 | email-subscribe (WordPress plugin) | The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all version | medium | 6.1 | 0% |
| CVE-2024-0957 | print-invoices-packing-slip-labels-for-woocommerce (WordPress plugin) | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scri | medium | 6.1 | 0% |
| CVE-2024-1782 | blue-triad-ezanalytics (WordPress plugin) | The Blue Triad EZAnalytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'bt_webid' parameter in all versions | medium | 6.1 | 0% |
| CVE-2024-1810 | archivist-custom-archive-templates (WordPress plugin) | The Archivist – Custom Archive Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode_attributes' | medium | 6.1 | 0% |
| CVE-2024-33997 | moodle/moodle | Moodle stored Cross-site Scripting (XSS) | medium | 6.1 | 0% |
| CVE-2024-3731 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versi | medium | 6.1 | 0% |
| CVE-2024-38274 | moodle/moodle | Moodle stored XSS via calendar's event title when deleting the event | medium | 6.1 | 0% |
| CVE-2024-5212 | tagdiv-composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions u | medium | 6.1 | 0% |
| CVE-2024-3992 | amen (WordPress plugin) | The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 4.8 | 0% |
| CVE-2024-6070 | if-so (WordPress plugin) | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not sanitise and escape some of its settings, which could all | medium | 4.8 | 0% |
| CVE-2024-6887 | rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, whic | medium | 4.8 | 0% |
| CVE-2024-6889 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whic | medium | 4.8 | 0% |
| CVE-2024-11203 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & | medium | 6.4 | 0% |
| CVE-2024-4643 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-8241 | nova-blocks (WordPress plugin) | The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separat | medium | 6.4 | 0% |
| CVE-2024-8276 | wpzoom-portfolio (WordPress plugin) | The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ at | medium | 6.4 | 0% |
| CVE-2024-8742 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2024-0238 | eventon (WordPress plugin) | The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and do | medium | 6.1 | 0% |
| CVE-2024-12047 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cus | medium | 6.1 | 0% |
| CVE-2024-12731 | infeed (WordPress plugin) | The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 0% |
| CVE-2024-5079 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenti | medium | 6.1 | 0% |
| CVE-2023-1575 | mega-main-menu (WordPress plugin) | The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, | medium | 5.5 | 0% |
| CVE-2024-6725 | formidable (WordPress plugin) | The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable | medium | 4.9 | 0% |
| CVE-2023-46925 | reportico-web/reportico | Reportico Cross-site Scripting vulnerability | medium | 4.8 | 0% |
| CVE-2023-6783 | wolfnet-idx-for-wordpress (WordPress plugin) | The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2024-2696 | swift-framework (WordPress plugin) | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-4664 | wp-chat-app (WordPress plugin) | The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-6165 | wanotifier (WordPress plugin) | The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-6927 | viral-signup (WordPress plugin) | The Viral Signup WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-3369 | about-me-3000 (WordPress plugin) | The About Me 3000 widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and includi | medium | 4.4 | 0% |
| CVE-2023-1159 | bookly-responsive-appointment-booking-tool (WordPress plugin) | The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due t | medium | 4.0 | 0% |
| CVE-2026-27599 | ci4-cms-erp/ci4ms | ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via | critical | 9.1 | 0% |
| CVE-2024-13699 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-1586 | schema-\&-structured-data-for-wp-\&-amp (WordPress plugin) | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all ver | medium | 6.4 | 0% |
| CVE-2024-4392 | jetpack (WordPress plugin) | The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvide | medium | 6.4 | 0% |
| CVE-2024-8236 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url | medium | 6.4 | 0% |