Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2919 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Cou | medium | 6.4 | 0% |
| CVE-2024-3285 | ml-slider (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 6.4 | 0% |
| CVE-2024-3343 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2025-51489 | moonshine/moonshine | MoonShine Arbitrary File Upload Vulnerability | medium | 4.5 | 0% |
| CVE-2024-13116 | crelly-slider (WordPress plugin) | The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users su | low | 3.8 | 0% |
| CVE-2024-50355 | librenms/librenms | LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints | high | 7.2 | 0% |
| CVE-2024-10187 | mycred (WordPress plugin) | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, an | medium | 6.4 | 0% |
| CVE-2024-3639 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Posts Grid widget in al | medium | 6.4 | 0% |
| CVE-2024-4160 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-4342 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, i | medium | 6.4 | 0% |
| CVE-2024-4385 | envo-extra (WordPress plugin) | The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1 | medium | 6.4 | 0% |
| CVE-2024-4458 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in several widgets via URL parameters | medium | 6.4 | 0% |
| CVE-2024-4459 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in al | medium | 6.4 | 0% |
| CVE-2024-4821 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbo | medium | 6.4 | 0% |
| CVE-2024-5229 | primary-addon-for-elementor (WordPress plugin) | The Primary Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in a | medium | 6.4 | 0% |
| CVE-2024-5576 | tutor-lms-elementor-addons (WordPress plugin) | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute wi | medium | 6.4 | 0% |
| CVE-2024-6263 | wp-lightbox-2 (WordPress plugin) | The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-8045 | advanced-backgrounds (WordPress plugin) | The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all ver | medium | 6.4 | 0% |
| CVE-2024-8103 | wp-category-dropdown (WordPress plugin) | The WP Category Dropdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-8317 | wpadcenter (WordPress plugin) | The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ad_alignment’ attribut | medium | 6.4 | 0% |
| CVE-2024-8919 | confetti-fall-animation (WordPress plugin) | The Confetti Fall Animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'confetti-fall-animation' sho | medium | 6.4 | 0% |
| CVE-2024-8964 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all ve | medium | 6.4 | 0% |
| CVE-2024-11107 | system-dashboard (WordPress plugin) | The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which cou | medium | 6.1 | 0% |
| CVE-2024-12768 | responsive-iframe (WordPress plugin) | The Responsive iframe WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a | medium | 5.4 | 0% |
| CVE-2025-3643 | moodle/moodle | Moodle has reflected Cross-site Scripting risk in policy tool | medium | 5.4 | 0% |
| CVE-2024-2218 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privi | medium | 4.6 | 0% |
| CVE-2023-4839 | wp-google-maps (WordPress plugin) | The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to | medium | 4.4 | 0% |
| CVE-2026-25483 | craftcms/commerce | Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration | medium | 0.0 | 0% |
| CVE-2025-53368 | starcitizentools/citizen-skin | starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions | high | 8.6 | 0% |
| CVE-2025-53369 | starcitizentools/short-description | Citizen Short Description stored XSS vulnerability through wikitext | high | 8.6 | 0% |
| CVE-2024-10057 | rss-feed-widget (WordPress plugin) | The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all v | medium | 6.4 | 0% |
| CVE-2024-10226 | arconix-shortcodes (WordPress plugin) | The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-1427 | the-post-grid (WordPress plugin) | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 6.4 | 0% |
| CVE-2024-1565 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for Wor | medium | 6.4 | 0% |
| CVE-2024-3603 | osm (WordPress plugin) | The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osm_map' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-3638 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Marquee Text Widget, Tes | medium | 6.4 | 0% |
| CVE-2024-3925 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-5219 | google-maps-easy (WordPress plugin) | The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions | medium | 6.4 | 0% |
| CVE-2024-5419 | cf7-widget-elementor (WordPress plugin) | The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_red | medium | 6.4 | 0% |
| CVE-2024-6264 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions u | medium | 6.4 | 0% |
| CVE-2024-6480 | sip-reviews-shortcode-woocommerce (WordPress plugin) | The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'no_of_reviews' attribut | medium | 6.4 | 0% |
| CVE-2023-35783 | tpwd/ke_search | ke_search (aka Faceted Search) vulnerable to Cross-Site Scripting | medium | 6.3 | 0% |
| CVE-2024-13711 | pollin (WordPress plugin) | The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' parameter in all versions up to, and incl | medium | 6.1 | 0% |
| CVE-2024-13822 | totalcontest (WordPress plugin) | The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting i | medium | 6.1 | 0% |
| CVE-2024-8633 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 5.5 | 0% |
| CVE-2024-32674 | heateor-social-login (WordPress plugin) | Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitra | medium | 5.4 | 0% |
| CVE-2024-56366 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file | high | 7.1 | 0% |
| CVE-2024-56409 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file | high | 7.1 | 0% |
| CVE-2024-0367 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link field of an installed wi | medium | 6.4 | 0% |
| CVE-2024-1054 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wcj_product_barcode' short | medium | 6.4 | 0% |