Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4273 | essential-real-estate (WordPress plugin) | The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ere_property_map' shortcode in | medium | 6.4 | 0% |
| CVE-2024-4288 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scrip | medium | 6.4 | 0% |
| CVE-2024-4313 | table-addons-for-elementor (WordPress plugin) | The Table Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-4375 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_layer' sh | medium | 6.4 | 0% |
| CVE-2024-4391 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Event Calendar widget in a | medium | 6.4 | 0% |
| CVE-2024-4470 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide_inf | medium | 6.4 | 0% |
| CVE-2024-4485 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-4553 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_member | medium | 6.4 | 0% |
| CVE-2024-4570 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, an | medium | 6.4 | 0% |
| CVE-2024-4626 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in | medium | 6.4 | 0% |
| CVE-2024-4707 | materialis-companion (WordPress plugin) | The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcod | medium | 6.4 | 0% |
| CVE-2024-4896 | wpb-elementor-addons (WordPress plugin) | The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, an | medium | 6.4 | 0% |
| CVE-2024-5038 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 0% |
| CVE-2024-5041 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ha-ia-content-button’ parameter in | medium | 6.4 | 0% |
| CVE-2024-5188 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-5220 | nd-shortcodes (WordPress plugin) | The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-5289 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-5327 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to DOM-Based Stored Cross-Sit | medium | 6.4 | 0% |
| CVE-2024-5567 | betheme (WordPress theme) | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5 | medium | 6.4 | 0% |
| CVE-2024-5628 | avada (WordPress plugin) | The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fus | medium | 6.4 | 0% |
| CVE-2024-6346 | post-grid (WordPress plugin) | The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL param | medium | 6.4 | 0% |
| CVE-2024-6363 | stock-ticker (WordPress plugin) | The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2024-7611 | enteraddons (WordPress plugin) | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' a | medium | 6.4 | 0% |
| CVE-2024-8107 | slider-revolution (WordPress plugin) | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-8960 | cowidgets-elementor-addons (WordPress plugin) | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up t | medium | 6.4 | 0% |
| CVE-2024-8961 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2024-9071 | easy-demo-importer (WordPress plugin) | The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG F | medium | 6.4 | 0% |
| CVE-2024-9072 | gdpr-consent-manager (WordPress plugin) | The GDPR-Extensions-com – Consent Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all vers | medium | 6.4 | 0% |
| CVE-2024-9708 | easy-svg-upload (WordPress plugin) | The Easy SVG Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2024-2092 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versio | medium | 5.4 | 0% |
| CVE-2024-4379 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in | medium | 5.4 | 0% |
| CVE-2024-6282 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | medium | 5.4 | 0% |
| CVE-2026-40301 | rhukster/dom-sanitizer | rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives | medium | 4.7 | 0% |
| CVE-2024-9306 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and incl | medium | 4.4 | 0% |
| CVE-2026-25489 | craftcms/commerce | Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2024-10388 | wordpress-gdpr (WordPress plugin) | The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters | high | 7.2 | 0% |
| CVE-2023-50879 | wordpress.com-editing-toolkit (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolk | medium | 6.5 | 0% |
| CVE-2023-50889 | beaver-builder (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder | medium | 6.5 | 0% |
| CVE-2023-6382 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide' sh | medium | 6.4 | 0% |
| CVE-2024-11910 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions u | medium | 6.4 | 0% |
| CVE-2024-11930 | taskbuilder (WordPress plugin) | The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi | medium | 6.4 | 0% |
| CVE-2024-4608 | sellkit (WordPress plugin) | The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross- | medium | 6.4 | 0% |
| CVE-2024-5006 | boostify-header-footer-builder (WordPress plugin) | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter | medium | 6.4 | 0% |
| CVE-2024-5092 | elegant-addons-for-elementor (WordPress plugin) | The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Switcher, Slider, and Ic | medium | 6.4 | 0% |
| CVE-2024-5259 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 6.4 | 0% |
| CVE-2024-5418 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slitems' attribute within the plugin | medium | 6.4 | 0% |
| CVE-2024-5427 | wp-cafe (WordPress plugin) | The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-5502 | piotnet-addons-for-elementor (WordPress plugin) | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual He | medium | 6.4 | 0% |
| CVE-2024-5601 | mediavine-create (WordPress plugin) | The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode in all vers | medium | 6.4 | 0% |
| CVE-2024-5640 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |