Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6270 | community-events (WordPress plugin) | The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-6910 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-7918 | pocket-widget (WordPress plugin) | The Pocket Widget WordPress plugin through 0.1.3 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2024-13155 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split He | medium | 6.4 | 0% |
| CVE-2024-5686 | wpzoom-elementor-addons (WordPress plugin) | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribu | medium | 6.4 | 0% |
| CVE-2024-43439 | moodle/moodle | Moodle reflected XSS via H5P error message | medium | 5.4 | 0% |
| CVE-2024-3634 | month-name-translation-benaceur (WordPress plugin) | The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2024-7716 | gs-logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-1840 | spotify-play-button-for-wordpress (WordPress plugin) | The Sp*tify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to | medium | 4.4 | 0% |
| CVE-2024-6691 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to | medium | 4.4 | 0% |
| CVE-2025-0817 | formcraft (WordPress plugin) | The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3 | high | 7.2 | 0% |
| CVE-2023-50893 | impreza (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution Impreza – WordPress Website | high | 7.1 | 0% |
| CVE-2023-51501 | uncode (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce | high | 7.1 | 0% |
| CVE-2024-13571 | post-timeline (WordPress plugin) | The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 0% |
| CVE-2024-13631 | om-stripe (WordPress plugin) | The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in the page, leading to a | high | 7.1 | 0% |
| CVE-2024-29932 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Tax | medium | 6.5 | 0% |
| CVE-2024-4934 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them | medium | 5.5 | 0% |
| CVE-2024-11183 | simple-side-tab (WordPress plugin) | The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-3918 | pet-manager (WordPress plugin) | The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2024-4621 | arforms (WordPress plugin) | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which cou | medium | 4.8 | 0% |
| CVE-2024-5529 | wp-quicklatex (WordPress plugin) | The WP QuickLaTeX WordPress plugin before 3.8.8 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2026-75831 | getgrav/grav | Grav: Stored XSS via Markdown audio/video media <source> URL | high | 7.6 | 0% |
| CVE-2024-1238 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button ID parameter in all versio | medium | 6.4 | 0% |
| CVE-2024-4695 | move-addons (WordPress plugin) | The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-47618 | sulu/sulu | Cross-site Scripting via uploaded SVG | medium | 6.1 | 0% |
| CVE-2024-4759 | mime-types-extended (WordPress plugin) | The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Au | medium | 5.5 | 0% |
| CVE-2025-48958 | froxlor/froxlor | Froxlor has an HTML Injection Vulnerability | medium | 5.5 | 0% |
| CVE-2023-3412 | image-map-pro-lite (WordPress plugin) | The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in | medium | 6.4 | 0% |
| CVE-2023-6877 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store | medium | 6.4 | 0% |
| CVE-2024-3563 | genesis-blocks (WordPress plugin) | The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-4697 | cowidgets-elementor-addons (WordPress plugin) | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_tag’ parameter in all ve | medium | 6.4 | 0% |
| CVE-2024-4868 | extensions-for-elementor (WordPress plugin) | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox wid | medium | 6.4 | 0% |
| CVE-2024-5457 | pandavideo (WordPress plugin) | The Panda Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and includin | medium | 6.4 | 0% |
| CVE-2024-5504 | rife-elementor-extensions (WordPress plugin) | The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within t | medium | 6.4 | 0% |
| CVE-2024-8267 | radio-player (WordPress plugin) | The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Stored Cross-Site | medium | 6.4 | 0% |
| CVE-2024-8323 | easy-pricing-tables (WordPress plugin) | The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFam | medium | 6.4 | 0% |
| CVE-2024-8442 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-8858 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘piechart_settings’ parameter in | medium | 6.4 | 0% |
| CVE-2024-8861 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up | medium | 6.4 | 0% |
| CVE-2024-9127 | sola-testimonials (WordPress plugin) | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2024-9178 | woo-floating-cart-lite (WordPress plugin) | The XT Floating Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions | medium | 6.4 | 0% |
| CVE-2024-9505 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget | medium | 6.4 | 0% |
| CVE-2024-9897 | streamweasels-twitch-integration (WordPress plugin) | The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-twitch-embed shor | medium | 6.4 | 0% |
| CVE-2024-11204 | forumwp (WordPress plugin) | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all v | medium | 6.1 | 0% |
| CVE-2024-12409 | simplepress (WordPress plugin) | The Simple:Press Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and | medium | 6.1 | 0% |
| CVE-2024-13705 | stageshow (WordPress plugin) | The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate es | medium | 6.1 | 0% |
| CVE-2023-1515 | pimcore/pimcore | Pimcore vulnerable to Cross-site Scripting (XSS) in Redirects | medium | 5.4 | 0% |
| CVE-2023-6624 | import-users-from-csv-with-meta (WordPress plugin) | The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in | medium | 4.9 | 0% |
| CVE-2024-5004 | cm-popup (WordPress plugin) | The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could all | medium | 4.8 | 0% |
| CVE-2026-116675 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization | high | 0.0 | 0% |