Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3309 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget's attributes in all v | medium | 6.4 | 0% |
| CVE-2024-3344 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-3490 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in | medium | 6.4 | 0% |
| CVE-2024-3560 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up | medium | 6.4 | 0% |
| CVE-2024-3598 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all version | medium | 6.4 | 0% |
| CVE-2024-3672 | ba-book-everything (WordPress plugin) | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-3732 | geodirectory (WordPress plugin) | The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scri | medium | 6.4 | 0% |
| CVE-2024-3883 | interactive-3d-flipbook-powered-physics-engine (WordPress plugin) | The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-9702 | social-rocket (WordPress plugin) | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-f | medium | 6.4 | 0% |
| CVE-2023-5606 | chatbot (WordPress plugin) | The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficie | medium | 4.4 | 0% |
| CVE-2025-1363 | url-shortener-\|-conversion-tracking-\|-ab-testing-\|-woocommerce (WordPress plugin) | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its | low | 3.5 | 0% |
| CVE-2026-34557 | ci4-cms-erp/ci4ms | CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-34558 | ci4-cms-erp/ci4ms | CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2024-12597 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_css' and 'inner | medium | 6.4 | 0% |
| CVE-2025-5235 | opensheetmusicdisplay (WordPress plugin) | The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2021-24388 | vikrentcar-car-rental-management-system (WordPress plugin) | In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the | medium | 5.4 | 0% |
| CVE-2021-24611 | keyword-meta (WordPress plugin) | The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they ar | medium | 5.4 | 0% |
| CVE-2024-6703 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.9 | 0% |
| CVE-2024-5447 | paypal-pay-now\,-buy-now\,-donation-and-cart-buttons-shortcode (WordPress plugin) | The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its setti | medium | 4.8 | 0% |
| CVE-2024-2963 | pocket-news-generator (WordPress plugin) | The Pocket News Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as "Consumer Key" and "A | medium | 4.4 | 0% |
| CVE-2024-2968 | wp-eggdrop (WordPress plugin) | The WP-Eggdrop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0. | medium | 4.4 | 0% |
| CVE-2025-5842 | mdl-shortcodes (WordPress plugin) | The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-12166 | ultimate-shortcodes-creator (WordPress plugin) | The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all | medium | 6.1 | 0% |
| CVE-2025-1511 | user-registration (WordPress plugin) | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Reflected | medium | 6.1 | 0% |
| CVE-2024-10818 | jsfiddle-shortcode (WordPress plugin) | The JSFiddle Shortcode WordPress plugin before 1.1.3 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2024-11718 | tarteaucitron-wp (WordPress plugin), couleurcitron/tarteaucitron-wp | The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users | medium | 5.4 | 0% |
| CVE-2024-5440 | dynamic-content-personalization (WordPress plugin) | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes befo | medium | 5.4 | 0% |
| CVE-2024-8851 | polls-cp (WordPress plugin) | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users s | medium | 5.4 | 0% |
| CVE-2024-8854 | polls-cp (WordPress plugin) | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users s | medium | 5.4 | 0% |
| CVE-2024-9238 | avif-uploader (WordPress plugin) | The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author t | medium | 5.4 | 0% |
| CVE-2024-9645 | post-grid (WordPress plugin) | The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of i | medium | 5.4 | 0% |
| CVE-2024-9662 | cyan-backup (WordPress plugin) | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-9663 | cyan-backup (WordPress plugin) | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-6362 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting the | medium | 4.6 | 0% |
| CVE-2022-3556 | cab-fare-calculator (WordPress plugin) | The Cab fare calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vehicle title setting in versions up to, a | medium | 4.4 | 0% |
| CVE-2024-2324 | fileorganizer (WordPress plugin) | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload | medium | 4.4 | 0% |
| CVE-2024-3946 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3. | medium | 4.4 | 0% |
| CVE-2024-6518 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.4 | 0% |
| CVE-2024-6520 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.4 | 0% |
| CVE-2024-6521 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.4 | 0% |
| CVE-2026-55793 | craftcms/cms | Craft CMS: Stored XSS via Structure entry title in table view | medium | 0.0 | 0% |
| CVE-2024-10631 | countdown-timer-for-wordpress-block-editor (WordPress plugin) | The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before | medium | 6.5 | 0% |
| CVE-2024-22150 | powerfolio (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery | medium | 6.5 | 0% |
| CVE-2024-24712 | social-login (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login Word | medium | 6.5 | 0% |
| CVE-2024-25594 | mywaze (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Savvy Wordpress Development MyWaze all | medium | 6.5 | 0% |
| CVE-2023-6956 | easyazon (WordPress plugin) | The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘easyazon-clo | medium | 6.1 | 0% |
| CVE-2024-10647 | ws-form (WordPress plugin) | The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due t | medium | 6.1 | 0% |
| CVE-2024-10685 | cf7-redirect-thank-you-page (WordPress plugin) | The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in | medium | 6.1 | 0% |
| CVE-2024-13223 | tabulate (WordPress plugin) | The Tabulate WordPress plugin through 2.10.3 does not sanitise and escape some parameters before outputting them back in the page, leading t | medium | 6.1 | 0% |
| CVE-2024-6073 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 0% |