Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8670 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-2753 | concrete5/concrete5 | Concrete CMS Stored XSS on the calendar color settings screen | low | 2.0 | 0% |
| CVE-2024-46998 | baserproject/basercms | baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature | high | 7.1 | 0% |
| CVE-2024-49758 | librenms/librenms | LibreNMS has a stored XSS in ExamplePlugin with Device's Notes | medium | 6.8 | 0% |
| CVE-2023-22713 | gutenberg-blocks-for-wordpress-download-manager (WordPress plugin) | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager p | medium | 6.5 | 0% |
| CVE-2023-23664 | convertbox-auto-embed (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ConvertBox ConvertBox Auto Embed WordPress plugin <= 1.0.19 versions | medium | 6.5 | 0% |
| CVE-2023-23670 | fancy-comments (WordPress plugin) | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions. | medium | 6.5 | 0% |
| CVE-2023-23685 | portfolio (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin <= 2.8.10 version | medium | 6.5 | 0% |
| CVE-2023-45067 | wordpress-simple-html-sitemap (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions. | medium | 6.5 | 0% |
| CVE-2024-9657 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.5 | 0% |
| CVE-2024-39682 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1 | medium | 6.4 | 0% |
| CVE-2024-4569 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, an | medium | 6.4 | 0% |
| CVE-2024-5088 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-41676 | openmage/magento-lts | Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs | medium | 4.1 | 0% |
| CVE-2024-10322 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up | medium | 6.4 | 0% |
| CVE-2024-2492 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Tweet widget in all ver | medium | 6.4 | 0% |
| CVE-2024-2513 | wp-chat-app (WordPress plugin) | The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-2783 | gamipress (WordPress plugin) | The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-2847 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 0% |
| CVE-2025-0350 | wow-carousel-for-divi-lite (WordPress plugin) | The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting v | medium | 6.4 | 0% |
| CVE-2025-1005 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion widget i | medium | 6.4 | 0% |
| CVE-2025-4669 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2025-4670 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 6.4 | 0% |
| CVE-2025-24017 | yeswiki/yeswiki | Unauthenticated DOM Based XSS in YesWiki | high | 7.6 | 0% |
| CVE-2024-13509 | ws-form (WordPress plugin) | The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, an | high | 7.2 | 0% |
| CVE-2025-0511 | usc-e-shop (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and | high | 7.2 | 0% |
| CVE-2025-0918 | smtp-sendgrid (WordPress plugin) | The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4 due | high | 7.2 | 0% |
| CVE-2025-0953 | smtp-sendinblue (WordPress plugin) | The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2 du | high | 7.2 | 0% |
| CVE-2025-0311 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all ve | medium | 6.4 | 0% |
| CVE-2023-6813 | auth0/wordpress | Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2024-5544 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up | medium | 6.1 | 0% |
| CVE-2024-5809 | wp-ajax-contact-form (WordPress plugin) | The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-6226 | wpstickybar (WordPress plugin) | The WpStickyBar WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 0% |
| CVE-2025-3421 | everest-forms (WordPress plugin) | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflec | medium | 6.1 | 0% |
| CVE-2024-10493 | element-pack (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 d | medium | 5.4 | 0% |
| CVE-2024-10563 | woo-cart-count-shortcode (WordPress plugin) | The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outp | medium | 5.4 | 0% |
| CVE-2024-10980 | element-pack (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 | medium | 5.4 | 0% |
| CVE-2024-11221 | full-screen-\(page\)-background-image-slideshow (WordPress plugin) | The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which coul | medium | 4.8 | 0% |
| CVE-2024-7769 | clicksold-idx (WordPress plugin) | The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-3754 | alemha-watermark (WordPress plugin) | The Alemha watermarker WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.7 | 0% |
| CVE-2024-3178 | concrete5/concrete5 | Concrete CMS Cross-site Scripting (XSS) in the Advanced File Search Filter | low | 3.1 | 0% |
| CVE-2024-3179 | concrete5/concrete5 | Concrete CMS Stored XSS in the Custom Class page editing | low | 3.1 | 0% |
| CVE-2024-3180 | concrete5/concrete5 | Concrete CMS Stored XSS in blocks of type file | low | 3.1 | 0% |
| CVE-2024-3181 | concrete5/concrete5 | Concrete CMS Stored XSS in the Search Field | low | 3.1 | 0% |
| CVE-2026-62368 | snipe/snipe-it | Snipe-IT: Stored XSS via Custom Field name in asset-list column headers | high | 8.1 | 0% |
| CVE-2024-2226 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-2788 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title HTML Tag in all versions | medium | 6.4 | 0% |
| CVE-2024-3053 | forminator (WordPress plugin) | The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-0427 | arforms (WordPress plugin) | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is | medium | 6.3 | 0% |
| CVE-2026-25491 | craftcms/cms | Craft CMS Vulnerable to Stored XSS in Entry Types Name | low | 0.0 | 0% |