Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12239 | powerpack-addon-for-beaver-builder (WordPress plugin) | The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the navigate parameter in all | medium | 6.1 | 0% |
| CVE-2024-10027 | wp-booking-calendar (WordPress plugin) | The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2024-3644 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-3921 | gianism (WordPress plugin) | The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-5286 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 4.8 | 0% |
| CVE-2025-23198 | librenms/librenms | LibreNMS Display Name Stored Cross-site Scripting vulnerability | medium | 4.6 | 0% |
| CVE-2023-5120 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter | medium | 4.4 | 0% |
| CVE-2024-3920 | flattr (WordPress plugin) | The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as | low | 3.5 | 0% |
| CVE-2024-1761 | wp-whatsapp (WordPress plugin) | The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2024-1957 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gi | medium | 6.4 | 0% |
| CVE-2024-9028 | wp-gpx-maps (WordPress plugin) | The WP GPX Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sgpx' shortcode in all versions up to, a | medium | 6.4 | 0% |
| CVE-2023-7085 | scalable-vector-graphics-\(svg\) (WordPress plugin) | The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as | medium | 5.4 | 0% |
| CVE-2024-13120 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 | medium | 4.8 | 0% |
| CVE-2024-6138 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, whic | medium | 4.8 | 0% |
| CVE-2024-1590 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin | medium | 4.6 | 0% |
| CVE-2023-26536 | spotify-play-button-for-wordpress (WordPress plugin) | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.05 v | medium | 6.5 | 0% |
| CVE-2023-6988 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortco | medium | 6.4 | 0% |
| CVE-2024-11195 | email-subscribe (WordPress plugin) | The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's print_email_subscribe_form s | medium | 6.4 | 0% |
| CVE-2023-6278 | biteship (WordPress plugin) | The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_err | medium | 6.1 | 0% |
| CVE-2024-12283 | wp-pipes (WordPress plugin) | The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and includin | medium | 6.1 | 0% |
| CVE-2024-1775 | nextend-facebook-connect (WordPress plugin) | The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_descr | medium | 5.4 | 0% |
| CVE-2024-33998 | moodle/moodle | Moodle Cross-site Scripting (XSS) | medium | 5.4 | 0% |
| CVE-2024-5968 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could a | medium | 4.8 | 0% |
| CVE-2023-2332 | pimcore/pimcore | Cross-site Scripting (XSS) in Conditions tab of Pricing Rules | medium | 4.0 | 0% |
| CVE-2023-5205 | add-custom-body-class (WordPress plugin) | The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_custom_body_class' value in version | medium | 6.4 | 0% |
| CVE-2024-5666 | extensions-for-elementor (WordPress plugin) | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button | medium | 6.4 | 0% |
| CVE-2024-0979 | dashboard-widgets-suite (WordPress plugin) | The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up | medium | 6.1 | 0% |
| CVE-2024-10825 | hide-my-wp (WordPress plugin) | The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions | medium | 6.1 | 0% |
| CVE-2024-13431 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Sc | medium | 6.1 | 0% |
| CVE-2024-3368 | all-in-one-seo (WordPress plugin) | The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which | medium | 6.1 | 0% |
| CVE-2022-46861 | custom-login-page-styler (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Zia Imtiaz Custom Login Page Styler for WordPress plugin <= 6.2 versions. | medium | 5.9 | 0% |
| CVE-2023-23710 | wordpress-social-login-and-register-\(discord\,-google\,-twitter\,-linkedin\) (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, | medium | 5.9 | 0% |
| CVE-2023-23884 | kanban-boards-for-wordpress (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions | medium | 5.9 | 0% |
| CVE-2023-25021 | fareharbor (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <= 3.6.6 versions. | medium | 5.9 | 0% |
| CVE-2023-25797 | vslider (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. | medium | 5.9 | 0% |
| CVE-2023-26008 | top-10---popular-posts (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin <= 3.2.4 v | medium | 5.9 | 0% |
| CVE-2023-26017 | jobs-for-wordpress (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.10.2 versions. | medium | 5.9 | 0% |
| CVE-2023-29434 | optin-forms (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress plugin | medium | 5.9 | 0% |
| CVE-2023-30876 | dave\'s-wordpress-live-search (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dave Ross Dave's WordPress Live Search plugin <= 4.8.1 versions. | medium | 5.9 | 0% |
| CVE-2023-34368 | kanban-boards (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions | medium | 5.9 | 0% |
| CVE-2024-5604 | bug-library (WordPress plugin) | The Bug Library WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.9 | 0% |
| CVE-2024-6231 | request-a-quote (WordPress plugin) | The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 5.9 | 0% |
| CVE-2024-3636 | pinpoint-booking-system (WordPress plugin) | The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high pri | medium | 5.4 | 0% |
| CVE-2024-56411 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header | medium | 5.4 | 0% |
| CVE-2023-23677 | gtmetrix (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions. | low | 3.8 | 0% |
| CVE-2023-50371 | advanced-page-visit-counter (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit | medium | 6.5 | 0% |
| CVE-2024-10103 | mailpoet (WordPress plugin) | In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on | medium | 6.1 | 0% |
| CVE-2024-13823 | 360-product-rotation (WordPress plugin) | The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-13865 | s3player (WordPress plugin) | The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 0% |
| CVE-2024-5281 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |