Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10180 | cf7-repeatable-fields (WordPress plugin) | The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's field_group shortc | medium | 6.4 | 0% |
| CVE-2024-9049 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group | medium | 6.4 | 0% |
| CVE-2025-1328 | mrlegend-typedjs (WordPress plugin) | The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter i | medium | 6.4 | 0% |
| CVE-2025-7035 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mla_tag_cloud and mla_term_li | medium | 6.4 | 0% |
| CVE-2022-41136 | shortcodes-ultimate (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugi | medium | 6.1 | 0% |
| CVE-2022-44741 | testimonial-slider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 o | medium | 6.1 | 0% |
| CVE-2023-7194 | meris-wp-theme (WordPress plugin) | The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Ref | medium | 6.1 | 0% |
| CVE-2024-11277 | 404-solution (WordPress plugin) | The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 | medium | 6.1 | 0% |
| CVE-2024-8726 | mailchimp-forms-by-mailmunch (WordPress plugin) | The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg withou | medium | 6.1 | 0% |
| CVE-2024-11357 | goodlayers-core (WordPress plugin) | The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contr | medium | 5.9 | 0% |
| CVE-2024-3630 | hl-twitter (WordPress plugin) | The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 5.4 | 0% |
| CVE-2024-3633 | webp-\&-svg-support (WordPress plugin) | The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Au | medium | 5.4 | 0% |
| CVE-2024-8444 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. | medium | 5.4 | 0% |
| CVE-2024-10632 | nokaut-offers-box (WordPress plugin) | The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege use | medium | 4.8 | 0% |
| CVE-2024-11190 | jwp-a11y (WordPress plugin) | The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-12874 | top-comments (WordPress plugin) | The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-6665 | kbucket (WordPress plugin) | The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2024-6713 | pvn-auth-popup (WordPress plugin) | The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-7556 | simple-share (WordPress plugin) | The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-11140 | real-wp-shop-lite-ajax-ecommerce-shopping-cart (WordPress plugin) | The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which c | low | 3.5 | 0% |
| CVE-2024-3996 | smart-post-show (WordPress plugin) | The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege user | low | 3.5 | 0% |
| CVE-2024-6711 | event-tickets-with-ticket-scanner (WordPress plugin) | The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users wi | low | 3.5 | 0% |
| CVE-2026-34569 | ci4-cms-erp/ci4ms | CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.9 | 0% |
| CVE-2026-34559 | ci4-cms-erp/ci4ms | CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-33172 | statamic/cms | Statamic has Stored XSS via SVG Sanitization Bypass | high | 8.7 | 0% |
| CVE-2024-9545 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_con | medium | 6.4 | 0% |
| CVE-2025-2806 | tagdiv-composer (WordPress plugin) | The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parame | medium | 6.1 | 0% |
| CVE-2026-77616 | mediawiki/semantic-media-wiki | Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token | medium | 6.1 | 0% |
| CVE-2023-44990 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plu | medium | 5.9 | 0% |
| CVE-2024-11108 | serious-slider (WordPress plugin) | The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2024-0974 | social-media-widget (WordPress plugin) | The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-2872 | swift-framework (WordPress plugin) | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-4753 | wp-secure-maintenance (WordPress plugin) | The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-4959 | frontend-checklist (WordPress plugin) | The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-5799 | cm-popup (WordPress plugin) | The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-7879 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-9835 | rss-feed-widget (WordPress plugin) | The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attr | medium | 4.8 | 0% |
| CVE-2024-10515 | seo-plugin-by-squirrly-seo (WordPress plugin) | In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to imple | low | 3.5 | 0% |
| CVE-2024-2220 | call-\/-chat-\/-contact-button (WordPress plugin) | The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2024-0845 | pdf-viewer-for-elementor (WordPress plugin) | The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to | medium | 6.4 | 0% |
| CVE-2024-2350 | cafe-lite (WordPress plugin) | The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and C | medium | 6.4 | 0% |
| CVE-2024-4364 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all version | medium | 6.4 | 0% |
| CVE-2024-4376 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all | medium | 6.4 | 0% |
| CVE-2024-4378 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets i | medium | 6.4 | 0% |
| CVE-2024-4401 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ and 'eae_slider_animation' param | medium | 6.4 | 0% |
| CVE-2024-4478 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group widget in all ver | medium | 6.4 | 0% |
| CVE-2024-4580 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 0% |
| CVE-2024-4669 | events-addon-for-elementor (WordPress plugin) | The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and | medium | 6.4 | 0% |
| CVE-2024-4700 | wp-table-builder (WordPress plugin) | The WP Table Builder – WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button element in al | medium | 6.4 | 0% |
| CVE-2024-5073 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |