Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5283 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-2762 | foogallery (WordPress plugin) | The FooGallery WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its G | medium | 5.4 | 0% |
| CVE-2026-55696 | privatebin/privatebin | PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-inter | medium | 4.3 | 0% |
| CVE-2024-43369 | ibexa/fieldtype-richtext | Persistent Cross-site Scripting in Ibexa RichText Field Type | high | 7.2 | 0% |
| CVE-2024-1168 | wp-seopress (WordPress plugin) | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social image URL in all versio | medium | 6.4 | 0% |
| CVE-2024-5994 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions | medium | 6.4 | 0% |
| CVE-2024-12302 | icegram-engage (WordPress plugin) | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and | medium | 6.1 | 0% |
| CVE-2024-12587 | contact-form-master (WordPress plugin) | The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-4057 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before | medium | 6.1 | 0% |
| CVE-2024-4289 | sailthru-triggermail (WordPress plugin) | The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages a | medium | 6.1 | 0% |
| CVE-2024-9651 | contact-form (WordPress plugin) | The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 6.1 | 0% |
| CVE-2024-5475 | responsive-video-embed (WordPress plugin) | The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting the | medium | 5.4 | 0% |
| CVE-2024-9641 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-0233 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outp | medium | 6.1 | 0% |
| CVE-2024-45964 | tribalsystems/zenario | Zenario Cross Site Scripting in the Image library | medium | 5.4 | 0% |
| CVE-2024-9892 | add-widget-after-content (WordPress plugin) | The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and | medium | 4.4 | 0% |
| CVE-2024-21515 | opencart/opencart | Cross site scripting in opencart | medium | 4.2 | 0% |
| CVE-2024-21516 | opencart/opencart | Cross site scripting in opencart | medium | 4.2 | 0% |
| CVE-2023-1661 | display-metadata (WordPress plugin) | The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post met | medium | 6.4 | 0% |
| CVE-2023-2498 | go-pricing (WordPress plugin) | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in ver | medium | 6.4 | 0% |
| CVE-2023-2558 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_ | medium | 6.4 | 0% |
| CVE-2024-4983 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-11356 | tour-master (WordPress plugin) | The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allo | medium | 6.1 | 0% |
| CVE-2022-2375 | wp-sticky-button (WordPress plugin) | The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenti | medium | 5.4 | 0% |
| CVE-2025-26530 | moodle/moodle | Moodle allows reflected XSS via question bank filter | high | 8.3 | 0% |
| CVE-2024-4362 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortco | medium | 6.4 | 0% |
| CVE-2024-11287 | ebook-store (WordPress plugin) | The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc | medium | 6.1 | 0% |
| CVE-2024-5644 | tournamatch (WordPress plugin) | The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-45960 | tribalsystems/zenario | Zenario allows authenticated admin users to upload PDF files containing malicious code | medium | 4.8 | 0% |
| CVE-2022-29430 | png-to-jpg (WordPress plugin) | Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable | medium | 4.7 | 0% |
| CVE-2024-5553 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via several parameters in all v | medium | 4.4 | 0% |
| CVE-2024-9027 | wpzoom-shortcodes (WordPress plugin) | The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-9895 | clover-online-orders (WordPress plugin) | The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo_receipt_link shortc | medium | 6.4 | 0% |
| CVE-2024-9967 | wp-show-more (WordPress plugin) | The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_more shortcode in all versions up t | medium | 6.4 | 0% |
| CVE-2024-6019 | music-request-manager (WordPress plugin) | The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticat | medium | 6.1 | 0% |
| CVE-2023-2021 | nilsteampassnet/teampass | nilsteampassnet/teampass vulnerable to stored cross-site scripting (XSS) | medium | 5.8 | 0% |
| CVE-2024-11720 | acf-frontend-form-element (WordPress plugin) | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up t | high | 7.2 | 0% |
| CVE-2024-10233 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_subscr | medium | 6.4 | 0% |
| CVE-2024-4892 | buddypress (WordPress plugin) | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-11327 | clickwhale (WordPress plugin) | The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Refle | medium | 6.1 | 0% |
| CVE-2024-13363 | adthrive-ads (WordPress plugin) | The Raptive Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'poc' parameter in all versions up to, and incl | medium | 6.1 | 0% |
| CVE-2024-6494 | wordpress-file-upload (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthe | medium | 6.1 | 0% |
| CVE-2023-41731 | wordpress-publish-post-email-notification (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress publish post email notification plugin < | medium | 5.9 | 0% |
| CVE-2024-13605 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-6335 | tracking-code-manager (WordPress plugin) | The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-6617 | header-footer-custom-code (WordPress plugin) | The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow hig | medium | 4.8 | 0% |
| CVE-2024-8284 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2024-8492 | hustle (WordPress plugin) | The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-8493 | the-events-calendar (WordPress plugin) | The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-8542 | everest-forms (WordPress plugin) | The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |