Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9227 | powerpress (WordPress plugin) | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a | medium | 4.8 | 0% |
| CVE-2024-9236 | team---wordpress-team-members-showcase (WordPress plugin) | The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 4.8 | 0% |
| CVE-2024-9390 | registrationmagic (WordPress plugin) | The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-4004 | advanced-cron-manager (WordPress plugin) | The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | 0% |
| CVE-2024-4091 | responsive-gallery-grid (WordPress plugin) | The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2025-0521 | post-smtp (WordPress plugin) | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, an | high | 7.2 | 0% |
| CVE-2024-13052 | dental-optimizer-patient-generator-app (WordPress plugin) | The Dental Optimizer Patient Generator App WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back i | high | 7.1 | 0% |
| CVE-2024-9601 | qubely (WordPress plugin) | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' par | medium | 6.5 | 0% |
| CVE-2024-6018 | music-request-manager (WordPress plugin) | The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an | medium | 6.1 | 0% |
| CVE-2024-6072 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it ba | medium | 6.1 | 0% |
| CVE-2024-8056 | mm-breaking-news (WordPress plugin) | The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an at | medium | 6.1 | 0% |
| CVE-2025-61457 | code16/sharp | code16 Sharp vulnerable to Cross Site Scripting (XSS) | medium | 6.1 | 0% |
| CVE-2025-0660 | concrete5/concrete5 | Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality | medium | 0.0 | 0% |
| CVE-2024-0249 | advanced-schedule-posts (WordPress plugin) | The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, l | high | 7.1 | 0% |
| CVE-2024-9068 | oneelements-ultimate-addons-for-elementor (WordPress plugin) | The OneElements – Best Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versio | medium | 6.4 | 0% |
| CVE-2024-9069 | graphicsly (WordPress plugin) | The Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) plugin for Wo | medium | 6.4 | 0% |
| CVE-2023-7228 | illi-link-party\! (WordPress plugin) | The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to | medium | 6.1 | 0% |
| CVE-2024-11502 | planning-center-online-giving (WordPress plugin) | The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before output | medium | 5.4 | 0% |
| CVE-2024-12722 | twitter-bootstrap-collapse-aka-accordian-shortcode (WordPress plugin) | The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attri | medium | 5.4 | 0% |
| CVE-2024-6668 | profilepro (WordPress plugin) | The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow | medium | 5.4 | 0% |
| CVE-2024-6718 | pvn-auth-popup (WordPress plugin) | The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2024-10554 | wp-advanced-search (WordPress plugin) | The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high p | low | 3.5 | 0% |
| CVE-2024-10560 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | 0% |
| CVE-2026-44737 | getgrav/grav | Grav: Stored XSS via page title (data[header][title]) in admin panel | medium | 0.0 | 0% |
| CVE-2026-34568 | ci4-cms-erp/ci4ms | CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-27196 | statamic/cms | Statamic affected by privilege escalation via stored cross-site scripting | high | 8.1 | 0% |
| CVE-2024-10342 | league-of-legends-shortcodes (WordPress plugin) | The League of Legends Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-13868 | url-shortener-\|-conversion-tracking-\|-ab-testing-\|-woocommerce (WordPress plugin) | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter | medium | 6.1 | 0% |
| CVE-2024-3966 | pray-for-me (WordPress plugin) | The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform | medium | 6.1 | 0% |
| CVE-2025-0470 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2024-10105 | jobs-for-wordpress (WordPress plugin) | The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 5.9 | 0% |
| CVE-2024-10472 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 5.9 | 0% |
| CVE-2024-2001 | cockpit-hq/cockpit | Cockpit CMS Cross-Site Scripting vulnerability | medium | 5.5 | 0% |
| CVE-2023-6498 | complianz-gdpr (WordPress plugin) | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all version | medium | 4.4 | 0% |
| CVE-2024-13306 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which coul | medium | 4.3 | 0% |
| CVE-2026-33035 | wwbn/avideo | Unauthenticated Reflected XSS via innerHTML in AVideo | medium | 0.0 | 0% |
| CVE-2024-3667 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in al | high | 7.4 | 0% |
| CVE-2024-10168 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-10186 | event-post (WordPress plugin) | The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to | medium | 6.4 | 0% |
| CVE-2024-10189 | anchor-episodes-index (WordPress plugin) | The Anchor Episodes Index (Spotify for Podcasters) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's anchor | medium | 6.4 | 0% |
| CVE-2024-10323 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions | medium | 6.4 | 0% |
| CVE-2024-12475 | wp-multi-store-locator (WordPress plugin) | The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due | medium | 6.4 | 0% |
| CVE-2024-13153 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions | medium | 6.4 | 0% |
| CVE-2024-2455 | element-pack (WordPress plugin) | The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | medium | 6.4 | 0% |
| CVE-2024-2618 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versio | medium | 6.4 | 0% |
| CVE-2024-3307 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget's att | medium | 6.4 | 0% |
| CVE-2024-3557 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpgmza shortcode | medium | 6.4 | 0% |
| CVE-2024-3926 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-4045 | optinmonster (WordPress plugin) | The Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-4087 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widg | medium | 6.4 | 0% |