Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12240 | siteorigin-panels (WordPress plugin) | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions | medium | 6.4 | 0% |
| CVE-2024-1759 | wp-ulike (WordPress plugin) | The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's disp | medium | 6.4 | 0% |
| CVE-2024-1808 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode | medium | 6.4 | 0% |
| CVE-2024-2111 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physic | medium | 6.4 | 0% |
| CVE-2024-2131 | move-addons (WordPress plugin) | The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's infobox and button widget i | medium | 6.4 | 0% |
| CVE-2024-2139 | master-addons (WordPress plugin) | The Master Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in all versio | medium | 6.4 | 0% |
| CVE-2024-2140 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Icons widge | medium | 6.4 | 0% |
| CVE-2024-2143 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in al | medium | 6.4 | 0% |
| CVE-2024-2170 | vk-all-in-one-expansion-unit (WordPress plugin) | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all ve | medium | 6.4 | 0% |
| CVE-2024-2289 | powerpack-for-beaver-builder (WordPress plugin) | The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link in multiple elements in | medium | 6.4 | 0% |
| CVE-2024-2305 | cards-for-beaver-builder (WordPress plugin) | The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BootstrapCard link in all versions u | medium | 6.4 | 0% |
| CVE-2024-2336 | popup-maker (WordPress plugin) | The Popup Maker – Popup for opt-ins, lead gen, & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sho | medium | 6.4 | 0% |
| CVE-2024-2457 | modal-window (WordPress plugin) | The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) | medium | 6.4 | 0% |
| CVE-2024-2468 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-2477 | wpdiscuz (WordPress plugin) | The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all | medium | 6.4 | 0% |
| CVE-2024-2491 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the *_html_tag* attribute of multip | medium | 6.4 | 0% |
| CVE-2024-2507 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up | medium | 6.4 | 0% |
| CVE-2024-2536 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HowTo block attributes in all | medium | 6.4 | 0% |
| CVE-2024-2789 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Calendy widget in all vers | medium | 6.4 | 0% |
| CVE-2024-2841 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-2936 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute of widgets in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-2946 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-3890 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-3989 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gallery Justi | medium | 6.4 | 0% |
| CVE-2024-4158 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 2 | medium | 6.4 | 0% |
| CVE-2024-4275 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-4277 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in a | medium | 6.4 | 0% |
| CVE-2024-4316 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-4339 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-4449 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-4481 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the | medium | 6.4 | 0% |
| CVE-2024-5425 | wp-jquery-lightbox (WordPress plugin) | The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, an | medium | 6.4 | 0% |
| CVE-2025-0506 | rise-blocks (WordPress plugin) | The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the titleTag param | medium | 6.4 | 0% |
| CVE-2024-12726 | clipart (WordPress plugin) | The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec | medium | 6.1 | 0% |
| CVE-2024-12733 | affiliateimportereb (WordPress plugin) | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leadi | medium | 6.1 | 0% |
| CVE-2024-13828 | badgearoo (WordPress plugin) | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 6.1 | 0% |
| CVE-2025-0368 | banner-garden (WordPress plugin) | The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 0% |
| CVE-2024-1730 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, | medium | 5.4 | 0% |
| CVE-2024-2120 | website-builder (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget | medium | 5.4 | 0% |
| CVE-2024-2121 | elementor-pro (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget i | medium | 5.4 | 0% |
| CVE-2024-2688 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 5.4 | 0% |
| CVE-2024-2732 | themify-shortcodes (WordPress plugin) | The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in | medium | 5.4 | 0% |
| CVE-2024-3730 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_li | medium | 5.4 | 0% |
| CVE-2024-3818 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 5.4 | 0% |
| CVE-2024-2108 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 4.6 | 0% |
| CVE-2024-12173 | master-slider (WordPress plugin) | The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2024-13125 | everest-forms (WordPress plugin) | The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2024-12278 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via any location that typically sanitizes data | high | 7.2 | 0% |
| CVE-2024-10565 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 6.1 | 0% |
| CVE-2024-10566 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 6.1 | 0% |