Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5192 | funnel-builder (WordPress plugin) | The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells | medium | 6.4 | 0% |
| CVE-2024-5226 | fuse-social-floating-sidebar (WordPress plugin) | The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all | medium | 6.4 | 0% |
| CVE-2024-5347 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'arrow' attribute within the plugin | medium | 6.4 | 0% |
| CVE-2024-5663 | bb-bootstrap-cards (WordPress plugin) | The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Cards widget in all versions | medium | 6.4 | 0% |
| CVE-2024-5664 | mp3-music-player-by-sonaar (WordPress plugin) | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-5790 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's | medium | 6.4 | 0% |
| CVE-2024-6575 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-6627 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's PDF View widget in all ver | medium | 6.4 | 0% |
| CVE-2024-6629 | all-in-one-video-gallery (WordPress plugin) | The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-6864 | wp-last-modified-info (WordPress plugin) | The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-mod | medium | 6.4 | 0% |
| CVE-2024-6870 | responsive-lightbox (WordPress plugin) | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-6894 | integracao-rd-station (WordPress plugin) | The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insuffic | medium | 6.4 | 0% |
| CVE-2024-6896 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all vers | medium | 6.4 | 0% |
| CVE-2024-6929 | dynamic-featured-image (WordPress plugin) | The Dynamic Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘dfiFeatured’ parameter in all versions | medium | 6.4 | 0% |
| CVE-2024-7356 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-7606 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-7778 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-7791 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arrow’ parame | medium | 6.4 | 0% |
| CVE-2024-8282 | ibtana-visual-editor (WordPress plugin) | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within th | medium | 6.4 | 0% |
| CVE-2024-8318 | attributes-for-blocks (WordPress plugin) | The Attributes for Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributesForBlocks’ parameter in all v | medium | 6.4 | 0% |
| CVE-2024-8967 | iworks-pwa (WordPress plugin) | The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all vers | medium | 6.4 | 0% |
| CVE-2024-8987 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Sto | medium | 6.4 | 0% |
| CVE-2024-9388 | black-widgets (WordPress plugin) | The Black Widgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to | medium | 6.4 | 0% |
| CVE-2024-9444 | element-ready-lite (WordPress plugin) | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all version | medium | 6.4 | 0% |
| CVE-2024-9655 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-12275 | canvasflow (WordPress plugin) | The Canvasflow for WordPress plugin through 1.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-12320 | team-rosters (WordPress plugin) | The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and inc | medium | 6.1 | 0% |
| CVE-2025-2164 | pixelstats (WordPress plugin) | The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all version | medium | 6.1 | 0% |
| CVE-2024-3113 | simple-form (WordPress plugin) | The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escap | medium | 5.9 | 0% |
| CVE-2024-5075 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 5.9 | 0% |
| CVE-2024-5573 | easy-table-of-contents (WordPress plugin) | The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privileg | medium | 5.9 | 0% |
| CVE-2024-6390 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which coul | medium | 5.9 | 0% |
| CVE-2024-9836 | rss-feed-widget (WordPress plugin) | The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.9 | 0% |
| CVE-2024-2375 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege us | medium | 5.4 | 0% |
| CVE-2024-10706 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2024-3410 | footer-contacts-bar (WordPress plugin) | The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.3 | 0% |
| CVE-2024-4957 | frontend-checklist (WordPress plugin) | The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.3 | 0% |
| CVE-2024-8914 | bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang (WordPress plugin) | The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross | high | 7.2 | 0% |
| CVE-2024-5945 | wp-svg-images (WordPress plugin) | The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2025-4577 | custom-facebook-feed (WordPress plugin) | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2023-50896 | weforms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weForms weForms – Easy Drag & Drop Con | medium | 5.9 | 0% |
| CVE-2024-2953 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, a | medium | 5.5 | 0% |
| CVE-2024-6669 | chatbot (WordPress plugin) | The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up | medium | 5.5 | 0% |
| CVE-2024-12595 | ahathat (WordPress plugin) | The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attrib | medium | 4.7 | 0% |
| CVE-2024-47638 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Cale | high | 7.1 | 0% |
| CVE-2025-5944 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in | medium | 6.4 | 0% |
| CVE-2023-6494 | woo-smart-quick-view (WordPress plugin) | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all version | medium | 4.4 | 0% |
| CVE-2024-13864 | countdown-timer (WordPress plugin) | The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 0% |
| CVE-2024-46996 | baserproject/basercms | baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature | medium | 6.3 | 0% |
| CVE-2024-11849 | pods (WordPress plugin) | The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 6.1 | 0% |