Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10679 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high pr | medium | 6.1 | 0% |
| CVE-2024-41374 | icecoder/icecoder | ICEcoder vulnerable to Cross Site Scripting | medium | 6.1 | 0% |
| CVE-2024-41375 | icecoder/icecoder | ICEcoder vulnerable to Cross Site Scripting | medium | 6.1 | 0% |
| CVE-2024-6493 | header-footer-custom-code (WordPress plugin) | The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow hig | medium | 4.8 | 0% |
| CVE-2024-6850 | carousel-slider (WordPress plugin) | The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-0689 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versions up to, and includ | medium | 4.4 | 0% |
| CVE-2026-25759 | statamic/cms | Statamic CMS vulnerable to privilege escalation via stored cross-site scripting | high | 8.7 | 0% |
| CVE-2024-12599 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown wid | medium | 6.4 | 0% |
| CVE-2024-8703 | z-downloads (WordPress plugin) | The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could al | medium | 6.1 | 0% |
| CVE-2026-55877 | symfony/ux-icons | symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses | medium | 6.1 | 0% |
| CVE-2026-71435 | statamic/cms | Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template | medium | 6.1 | 0% |
| CVE-2026-52772 | yeswiki/yeswiki | YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html')) | medium | 5.5 | 0% |
| CVE-2024-10637 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before out | medium | 5.4 | 0% |
| CVE-2026-54717 | silverstripe/cms | Silverstripe: XSS in breadcrumbs in page list view | medium | 5.4 | 0% |
| CVE-2026-55779 | silverstripe/versioned | silverstripe/versioned has XSS in archive admin restore | medium | 5.4 | 0% |
| CVE-2024-3944 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 1.3.0 due t | medium | 4.4 | 0% |
| CVE-2026-29173 | craftcms/commerce | Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table | low | 0.0 | 0% |
| CVE-2026-45753 | symfony/html-sanitizer, symfony/symfony | Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) | low | 0.0 | 0% |
| CVE-2026-49210 | symfony/ux-live-component | symfony/ux-live-component: XSS via attacker-controlled child component tag | medium | 0.0 | 0% |
| CVE-2024-31108 | iflychat (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iFlyChat Team iFlyChat – WordPress Cha | medium | 6.5 | 0% |
| CVE-2024-10091 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all ve | medium | 6.4 | 0% |
| CVE-2024-11400 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really | medium | 6.1 | 0% |
| CVE-2024-56410 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties | medium | 5.4 | 0% |
| CVE-2024-4899 | seopress (WordPress plugin) | The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users suc | medium | 5.0 | 0% |
| CVE-2024-0656 | password-protected (WordPress plugin) | The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored C | medium | 4.4 | 0% |
| CVE-2024-0658 | insert-php-code-snippet (WordPress plugin) | The Insert PHP Code Snippet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's name when accessing the insert- | medium | 4.4 | 0% |
| CVE-2024-29804 | fancy-comments (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Fancy Comments WordPress | medium | 6.5 | 0% |
| CVE-2025-3888 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and inclu | medium | 6.4 | 0% |
| CVE-2024-10250 | nioland (WordPress theme) | The Nioland theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in all versions up to, and including, | medium | 6.1 | 0% |
| CVE-2024-6074 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 0% |
| CVE-2024-9382 | gantry (WordPress plugin) | The Gantry 4 Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'override_id' parameter in all versions | medium | 6.1 | 0% |
| CVE-2024-9653 | menu-ordering-reservations (WordPress plugin) | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the | medium | 6.1 | 0% |
| CVE-2023-51536 | crm-perks-forms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms – WordPress | medium | 5.9 | 0% |
| CVE-2024-13113 | countdown-timer-for-elementor (WordPress plugin) | The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the pag | medium | 5.9 | 0% |
| CVE-2024-12393 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status mes | medium | 5.4 | 0% |
| CVE-2023-6456 | wp-review-slider (WordPress plugin) | The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-10555 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow hi | medium | 4.8 | 0% |
| CVE-2024-13493 | sensly-online-presence (WordPress plugin) | The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-7618 | peepso-core (WordPress plugin) | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 4.4 | 0% |
| CVE-2024-7655 | peepso-core (WordPress plugin) | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 4.4 | 0% |
| CVE-2026-26987 | librenms/librenms | LibreNMS affected by reflected xss via email field | medium | 0.0 | 0% |
| CVE-2023-6958 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-1508 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings['title_tags']' a | medium | 6.4 | 0% |
| CVE-2024-2234 | himer (WordPress plugin) | The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such a | medium | 5.4 | 0% |
| CVE-2025-43717 | pear/http_request2 | PEAR HTTP_Request2 vulnerable to Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2023-5911 | wp-custom-cursors-\|-wordpress-cursor-plugin (WordPress plugin) | The WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could | medium | 4.8 | 0% |
| CVE-2024-3276 | foobox (WordPress plugin) | The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 do | medium | 4.8 | 0% |
| CVE-2024-0977 | timeline-widget-addon-for-elementor (WordPress plugin) | The Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) plugin for WordPress is vulnerable to Stored Cross-Si | medium | 4.4 | 0% |
| CVE-2025-28254 | leantime/leantime | Leantime affected by Improper Neutralization of HTML Tags | medium | 6.5 | 0% |
| CVE-2024-4702 | mega-elements-addons-for-elementor (WordPress plugin) | The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, an | medium | 6.4 | 0% |