Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10268 | mp3-music-player-by-sonaar (WordPress plugin) | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-3345 | woolentor-addons (WordPress plugin) | The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woolentorsearch shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-4361 | siteorigin-panels (WordPress plugin) | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortc | medium | 6.4 | 0% |
| CVE-2024-4634 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hfe_svg_mime_types’ functio | medium | 6.4 | 0% |
| CVE-2024-4876 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popover_header_text’ | medium | 6.4 | 0% |
| CVE-2024-12467 | pago-redsys-tpv-grafreak (WordPress plugin) | The Pago por Redsys plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Ds_MerchantParameters' parameter in all ve | medium | 6.1 | 0% |
| CVE-2024-13218 | fast-tube (WordPress plugin) | The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 0% |
| CVE-2023-2171 | badgeos (WordPress plugin) | The BadgeOS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including | medium | 5.4 | 0% |
| CVE-2024-3978 | wordpress-jitsi-shortcode (WordPress plugin) | The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting t | medium | 5.4 | 0% |
| CVE-2024-11645 | float-block (WordPress plugin) | The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-9776 | image-gallery (WordPress plugin) | The ImagePress – Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, a | medium | 4.4 | 0% |
| CVE-2025-46346 | yeswiki/yeswiki | YesWiki Stored XSS Vulnerability in Comments | low | 0.0 | 0% |
| CVE-2024-10646 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | high | 7.2 | 0% |
| CVE-2024-5199 | spotify-play-button (WordPress plugin) | The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2024-4970 | widget-bundle (WordPress plugin) | The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2023-4648 | wp-customer-reviews (WordPress plugin) | The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and includin | medium | 4.4 | 0% |
| CVE-2025-8571 | concrete5/concrete5 | Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page | medium | 0.0 | 0% |
| CVE-2023-25365 | october/october | October CMS Cross-site Scripting vulnerability | high | 7.8 | 0% |
| CVE-2024-1377 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author_meta_tag’ attribute of the | medium | 6.4 | 0% |
| CVE-2024-1987 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all vers | medium | 6.4 | 0% |
| CVE-2024-2337 | easy-testimonials (WordPress plugin) | The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonials_grid ' shortcode in a | medium | 6.4 | 0% |
| CVE-2024-6340 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all | medium | 6.4 | 0% |
| CVE-2026-71478 | league/commonmark | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes | medium | 6.1 | 0% |
| CVE-2023-41241 | surecart (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SureCart WordPress Ecommerce For Creating Fast Online Stores plugin <= 2.5 | medium | 5.9 | 0% |
| CVE-2024-10362 | social-media-share-buttons-\&-social-sharing-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which | medium | 4.8 | 0% |
| CVE-2024-12743 | mailpoet (WordPress plugin) | The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-12770 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-13128 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-2643 | my-sticky-bar (WordPress plugin) | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does no | medium | 4.8 | 0% |
| CVE-2024-6708 | profile-builder (WordPress plugin) | The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the a | medium | 4.8 | 0% |
| CVE-2024-8618 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-8759 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-2258 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 4.4 | 0% |
| CVE-2024-4002 | carousel\,-slider\,-gallery-by-wp-carousel (WordPress plugin) | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could a | low | 3.5 | 0% |
| CVE-2024-29142 | better-search (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebberZone Better Search – Relevant se | high | 7.1 | 0% |
| CVE-2024-10784 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-4374 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up t | medium | 6.4 | 0% |
| CVE-2023-4826 | socialdriver (WordPress plugin) | The SocialDriver WordPress theme before version 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrar | medium | 6.1 | 0% |
| CVE-2024-11644 | wp-svg (WordPress plugin) | The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/ | medium | 5.9 | 0% |
| CVE-2024-45406 | craftcms/cms | Craft CMS vulnerable to stored XSS in breadcrumb list and title fields | medium | 5.5 | 0% |
| CVE-2024-6710 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contri | medium | 5.4 | 0% |
| CVE-2024-3899 | envira-gallery (WordPress plugin) | The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow | medium | 4.8 | 0% |
| CVE-2024-4384 | cssable-countdown (WordPress plugin) | The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2025-7053 | cockpit-hq/cockpit | Cockpit - Content Platform vulnerable to XSS through name or email argument names | low | 3.5 | 0% |
| CVE-2024-2650 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-4373 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-5060 | include-lottie-animation-for-elementor (WordPress plugin) | The LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in | medium | 6.4 | 0% |
| CVE-2024-3241 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-5713 | if-so (WordPress plugin) | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outpu | medium | 5.4 | 0% |
| CVE-2024-6243 | html-forms (WordPress plugin) | The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as | medium | 4.8 | 0% |