Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5039 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2024-5554 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2025-48447 | drupal/lightgallery | This module integrates Drupal with LightGallery, enabling the use of the LightGallery library with any image field or vi | medium | 6.3 | 0% |
| CVE-2024-29906 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Tax | medium | 5.9 | 0% |
| CVE-2024-5170 | logo-manager-for-enamad (WordPress plugin) | The Logo Manager For Enamad WordPress plugin through 0.7.1 does not sanitise and escape in its widgets settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-1766 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and | medium | 4.4 | 0% |
| CVE-2024-2958 | svs-pricing-tables (WordPress plugin) | The SVS Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via pricing table settings in all versions up to, a | medium | 4.4 | 0% |
| CVE-2025-10316 | lavitto/typo3-form-to-database | TYPO3 "Form to Database" extension susceptible to Cross-site Scripting | low | 0.0 | 0% |
| CVE-2026-57440 | starcitizenwiki/embedvideo | Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled | high | 7.5 | 0% |
| CVE-2025-1561 | apppresser (WordPress plugin) | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all ver | high | 7.2 | 0% |
| CVE-2024-24801 | owl-carousel (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt OWL Carousel – WordPress Owl | medium | 6.5 | 0% |
| CVE-2024-10055 | support-chat (WordPress plugin) | The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2024-10178 | gutentor (WordPress plugin) | The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | medium | 6.4 | 0% |
| CVE-2024-10872 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block i | medium | 6.4 | 0% |
| CVE-2024-2785 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate widget in all versions | medium | 6.4 | 0% |
| CVE-2024-2798 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget container | medium | 6.4 | 0% |
| CVE-2024-2922 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget tags in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-3559 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_content]' parameter versions | medium | 6.4 | 0% |
| CVE-2024-3645 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Counter widget in | medium | 6.4 | 0% |
| CVE-2024-3889 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Accordi | medium | 6.4 | 0% |
| CVE-2024-5162 | prettyphoto (WordPress plugin) | The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-9443 | basticom-framework (WordPress plugin) | The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2023-46074 | freshmail-for-wordpress (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Borbis Media FreshMail For WordPress plugin <= 2.3.2 versions. | medium | 5.8 | 0% |
| CVE-2024-2470 | simple-ajax-chat (WordPress plugin) | The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 5.4 | 0% |
| CVE-2024-43437 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2024-4756 | wp-backpack (WordPress plugin) | The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-6766 | shortcodes-ultimate (WordPress plugin) | The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2024-9020 | list-category-posts (WordPress plugin) | The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2024-54774 | dcat/laravel-admin | Dcat Admin Cross-site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2024-7052 | forminator-forms (WordPress plugin) | The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2026-32277 | opensource-workshop/connect-cms | Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View | high | 8.7 | 0% |
| CVE-2024-56365 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class | high | 7.1 | 0% |
| CVE-2024-2697 | swift-framework (WordPress plugin) | The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting | medium | 6.5 | 0% |
| CVE-2023-2439 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, | medium | 6.4 | 0% |
| CVE-2024-13332 | transfinanz (WordPress plugin) | The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 0% |
| CVE-2024-12042 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pro | medium | 5.4 | 0% |
| CVE-2024-12772 | ninja-tables (WordPress plugin) | The Ninja Tables WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in the page when importi | medium | 5.4 | 0% |
| CVE-2024-10939 | image-widget (WordPress plugin) | The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privi | medium | 4.8 | 0% |
| CVE-2024-11636 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which | medium | 4.8 | 0% |
| CVE-2024-3937 | playlist-for-youtube (WordPress plugin) | The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-3973 | house-manager (WordPress plugin) | The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 4.8 | 0% |
| CVE-2024-4381 | commonsbooking (WordPress plugin) | The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-6498 | collect.chat (WordPress plugin) | The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could al | medium | 4.8 | 0% |
| CVE-2024-8857 | wordpress-auction (WordPress plugin) | The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2025-64049 | redaxo/source | REDAXO CMS is vulnerable to XSS through its module management component | medium | 4.8 | 0% |
| CVE-2024-22159 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF – WordPress Posts Bulk | high | 7.1 | 0% |
| CVE-2024-23508 | pdf-poster (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plu | high | 7.1 | 0% |
| CVE-2024-24927 | brooklyn (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnitedThemes Brooklyn | Creative Multi | high | 7.1 | 0% |
| CVE-2026-84192 | librenms/librenms | LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates | high | 7.1 | 0% |
| CVE-2026-41201 | ci4-cms-erp/ci4ms | CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS | medium | 6.8 | 0% |