Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5645 | envo-extra (WordPress plugin) | The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_css_id’ parameter within the Button widget | medium | 6.4 | 0% |
| CVE-2024-6930 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's booki | medium | 6.4 | 0% |
| CVE-2024-9057 | curatorio (WordPress plugin) | The Curator.io: Show all your social media posts in a beautiful feed. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-9172 | demo-importer-plus (WordPress plugin) | The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-9242 | memberful-wp (WordPress plugin) | The Memberful – Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'memberful_buy_subscrip | medium | 6.4 | 0% |
| CVE-2024-9425 | advanced-category-and-custom-taxonomy-image (WordPress plugin) | The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ad_tax_im | medium | 6.4 | 0% |
| CVE-2023-0926 | custom-permalinks (WordPress plugin) | The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insuf | medium | 4.4 | 0% |
| CVE-2024-11052 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cal | high | 7.2 | 0% |
| CVE-2024-13497 | tripetto (WordPress plugin) | The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site | high | 7.2 | 0% |
| CVE-2023-6892 | ean-for-woocommerce (WordPress plugin) | The EAN for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_ean_product_meta' shortco | medium | 6.4 | 0% |
| CVE-2024-0256 | starbox (WordPress plugin) | The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versio | medium | 6.4 | 0% |
| CVE-2024-0824 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Anything functionality in | medium | 6.4 | 0% |
| CVE-2024-10453 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-1049 | vimeography (WordPress plugin) | The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget' | medium | 6.4 | 0% |
| CVE-2024-1057 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-1081 | interactive-3d-flipbook-powered-physics-engine (WordPress plugin) | The 3D FlipBook – PDF Flipbook WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bookmark feature | medium | 6.4 | 0% |
| CVE-2024-12205 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all vers | medium | 6.4 | 0% |
| CVE-2024-1327 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image box widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-1364 | elementor-pro (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions u | medium | 6.4 | 0% |
| CVE-2024-1421 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribut | medium | 6.4 | 0% |
| CVE-2024-1426 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter G | medium | 6.4 | 0% |
| CVE-2024-1429 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter G | medium | 6.4 | 0% |
| CVE-2024-1521 | elementor-pro (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form w | medium | 6.4 | 0% |
| CVE-2024-1534 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions | medium | 6.4 | 0% |
| CVE-2024-1582 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgmza' shortco | medium | 6.4 | 0% |
| CVE-2024-1767 | blocksy (WordPress plugin) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2 | medium | 6.4 | 0% |
| CVE-2024-1802 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-1805 | page-builder (WordPress plugin) | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2024-1840 | page-builder (WordPress plugin) | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Author tag attribute in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-1841 | page-builder (WordPress plugin) | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title tag attribute in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2024-1842 | page-builder (WordPress plugin) | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Heading tag attribute in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-2031 | video-conferencing-with-zoom-api (WordPress plugin) | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meet | medium | 6.4 | 0% |
| CVE-2024-2079 | addons-for-visual-composer (WordPress plugin) | The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mo | medium | 6.4 | 0% |
| CVE-2024-2084 | ht-mega (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox widg | medium | 6.4 | 0% |
| CVE-2024-2085 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' value in severa | medium | 6.4 | 0% |
| CVE-2024-2132 | ultimate-bootstrap-elements-for-elementor (WordPress plugin) | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Widget in all | medium | 6.4 | 0% |
| CVE-2024-2136 | wpkoi-templates-for-elementor (WordPress plugin) | The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget in all v | medium | 6.4 | 0% |
| CVE-2024-2137 | widgetkit-for-elementor (WordPress plugin) | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widge | medium | 6.4 | 0% |
| CVE-2024-2249 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute foun | medium | 6.4 | 0% |
| CVE-2024-2273 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several | medium | 6.4 | 0% |
| CVE-2024-2308 | elementinvader-addons-for-elementor (WordPress plugin) | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link in the EliSlid | medium | 6.4 | 0% |
| CVE-2024-2750 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button wid | medium | 6.4 | 0% |
| CVE-2024-2751 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_st | medium | 6.4 | 0% |
| CVE-2024-2781 | elementor-pro (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_html_tag attribute in all | medium | 6.4 | 0% |
| CVE-2024-2790 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Accordion widget in all ve | medium | 6.4 | 0% |
| CVE-2024-2791 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all | medium | 6.4 | 0% |
| CVE-2024-2839 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode i | medium | 6.4 | 0% |
| CVE-2024-2842 | easy-appointments (WordPress plugin) | The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-3162 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all version | medium | 6.4 | 0% |
| CVE-2024-3245 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |