Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-44657 | mantisbt/mantisbt | MantisBT Vulnerable to Stored XSS in File Download | high | 0.0 | 0% |
| CVE-2024-13704 | super-testimonial (WordPress plugin) | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions u | high | 7.2 | 0% |
| CVE-2024-22075 | grumpydictator/firefly-iii | Firefly III allows webhooks HTML Injection. | medium | 6.5 | 0% |
| CVE-2023-6744 | divi (WordPress plugin) | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-2787 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title HTML Tag in all versions | medium | 6.4 | 0% |
| CVE-2024-8799 | custom-banners (WordPress plugin) | The Custom Banners plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-9462 | poll-maker (WordPress plugin) | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll setti | medium | 5.5 | 0% |
| CVE-2021-24912 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could al | medium | 5.4 | 0% |
| CVE-2024-9599 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-7891 | floating-contact-button (WordPress plugin) | The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-27087 | getkirby/cms | Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type | medium | 4.6 | 0% |
| CVE-2024-12736 | bu-section-editing (WordPress plugin) | The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leadin | medium | 6.1 | 0% |
| CVE-2024-25399 | intelliants/subrion | Subrion CMS vulnerable to Cross Site Scripting | medium | 6.1 | 0% |
| CVE-2024-3917 | pet-manager (WordPress plugin) | The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 0% |
| CVE-2024-7692 | flaming-forms (WordPress plugin) | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-9428 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2024-32877 | yiisoft/yii2 | Reflected Cross-site Scripting in yiisoft/yii2 Debug mode | medium | 4.2 | 0% |
| CVE-2024-23517 | scheduling-plugin (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Start Booking Scheduling Plugin – Onli | medium | 6.5 | 0% |
| CVE-2024-11685 | kudos-donations (WordPress plugin) | The `Kudos Donations – Easy donations and payments with Mollie` plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to | medium | 6.1 | 0% |
| CVE-2024-12725 | clasify-classified-listing (WordPress plugin) | The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page | medium | 6.1 | 0% |
| CVE-2024-46995 | baserproject/basercms | baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request | medium | 6.1 | 0% |
| CVE-2023-3142 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2024-32981 | silverstripe/framework | Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload | medium | 5.4 | 0% |
| CVE-2024-10545 | nextgen-gallery (WordPress plugin) | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which cou | low | 3.5 | 0% |
| CVE-2023-50874 | ajax-load-more (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scrol | medium | 6.5 | 0% |
| CVE-2023-6645 | post-grid (WordPress plugin) | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in | medium | 6.4 | 0% |
| CVE-2024-5024 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mepr_screenname' and 'mepr_key' parameter in a | medium | 6.1 | 0% |
| CVE-2024-5282 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-6272 | spidercontacts (WordPress plugin) | The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-9934 | wp-imagezoom (WordPress plugin) | The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading | medium | 6.1 | 0% |
| CVE-2023-4500 | order-tracking (WordPress plugin) | The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, a | medium | 4.7 | 0% |
| CVE-2026-25482 | craftcms/commerce | Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) | medium | 0.0 | 0% |
| CVE-2026-48761 | symfony/html-sanitizer, symfony/symfony | Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes | medium | 0.0 | 0% |
| CVE-2024-0837 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter G | medium | 6.4 | 0% |
| CVE-2024-1796 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2024-2127 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom att | medium | 6.4 | 0% |
| CVE-2024-2471 | foogallery (WordPress plugin) | The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', ' | medium | 6.4 | 0% |
| CVE-2024-2949 | wp-carousel-free (WordPress plugin) | The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid fo | medium | 6.4 | 0% |
| CVE-2024-9618 | master-addons (WordPress plugin) | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnera | medium | 6.4 | 0% |
| CVE-2025-2575 | z-companion (WordPress plugin) | The Z Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2022-1757 | pagebar (WordPress plugin) | The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a | medium | 5.4 | 0% |
| CVE-2024-10504 | arforms (WordPress plugin) | The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputt | medium | 5.4 | 0% |
| CVE-2024-45292 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks | medium | 5.4 | 0% |
| CVE-2023-50892 | thegem (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Pu | high | 7.1 | 0% |
| CVE-2024-10080 | easy-post-types (WordPress plugin) | The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4 | medium | 6.4 | 0% |
| CVE-2024-1419 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ attribute of the Header Me | medium | 6.4 | 0% |
| CVE-2024-1506 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tags' attribute of | medium | 6.4 | 0% |
| CVE-2024-2345 | filebird (WordPress plugin) | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fold | medium | 6.4 | 0% |
| CVE-2024-2392 | blocksy-companion (WordPress plugin) | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions u | medium | 6.4 | 0% |
| CVE-2024-2803 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions | medium | 6.4 | 0% |