Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9241 | pdf-image-generator (WordPress plugin) | The PDF Image Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropr | medium | 6.1 | 0% |
| CVE-2024-9375 | captcha-bank (WordPress plugin) | The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer | medium | 6.1 | 0% |
| CVE-2024-9607 | wd-facebook-feed (WordPress plugin) | The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appr | medium | 6.1 | 0% |
| CVE-2024-9864 | eventprime (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in | medium | 6.1 | 0% |
| CVE-2021-24822 | stylish-cost-calculator (WordPress plugin) | The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (avail | medium | 5.4 | 0% |
| CVE-2025-32378 | shopware/core, shopware/platform | Shopware default newsletter opt-in settings allow for mass sign-up abuse | medium | 5.3 | 0% |
| CVE-2023-4728 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publish_lp() fu | medium | 4.3 | 0% |
| CVE-2025-9823 | mautic/core | Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add | medium | 0.0 | 0% |
| CVE-2024-2691 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | medium | 6.4 | 0% |
| CVE-2024-7599 | advanced-sermons (WordPress plugin) | The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermon_video_embed’ parameter in all version | medium | 6.4 | 0% |
| CVE-2023-47526 | chartify (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chart Builder Team Chartify – WordPres | medium | 5.9 | 0% |
| CVE-2024-13101 | wp-mediatagger (WordPress plugin) | The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2023-6594 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions | medium | 4.4 | 0% |
| CVE-2024-13340 | wp-meta-data-filter-and-taxonomy-filter (WordPress plugin) | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdf_results_b | medium | 6.4 | 0% |
| CVE-2024-5222 | responsive-add-ons (WordPress plugin) | The Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2022-3149 | wp-custom-cursors (WordPress plugin) | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow a | medium | 6.1 | 0% |
| CVE-2024-1743 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back i | medium | 5.9 | 0% |
| CVE-2024-37959 | power-bi-embedded (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Atlas Public Policy Power BI Em | medium | 5.9 | 0% |
| CVE-2024-3111 | h5p (WordPress plugin) | The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malic | medium | 5.4 | 0% |
| CVE-2024-4377 | dot-on-paper-shortcodes (WordPress plugin) | The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2024-5448 | paypal-pay-now\,-buy-now\,-donation-and-cart-buttons-shortcode (WordPress plugin) | The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its short | medium | 5.4 | 0% |
| CVE-2024-41709 | backdrop/backdrop | Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places | medium | 4.8 | 0% |
| CVE-2026-55481 | snipe/snipe-it | Snipe-IT has CSS Injection via `header_color` Setting | medium | 0.0 | 0% |
| CVE-2024-10269 | easy-svg (WordPress plugin) | The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-10308 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdown widget in all vers | medium | 6.4 | 0% |
| CVE-2024-10325 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all | medium | 6.4 | 0% |
| CVE-2024-11230 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all vers | medium | 6.4 | 0% |
| CVE-2024-12463 | arena-liveblog-and-chat-tool (WordPress plugin) | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arena_ | medium | 6.4 | 0% |
| CVE-2024-13584 | picture-gallery (WordPress plugin) | The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-13599 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including | medium | 6.4 | 0% |
| CVE-2024-3565 | custom-post-widget (WordPress plugin) | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_block' s | medium | 6.4 | 0% |
| CVE-2024-4488 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inline_list’ parameter in versi | medium | 6.4 | 0% |
| CVE-2024-4489 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ fun | medium | 6.4 | 0% |
| CVE-2024-5152 | element-ready-lite (WordPress plugin) | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all vers | medium | 6.4 | 0% |
| CVE-2024-5161 | magical-addons-for-elementor (WordPress plugin) | The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vuln | medium | 6.4 | 0% |
| CVE-2024-5177 | hash-elements (WordPress plugin) | The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all v | medium | 6.4 | 0% |
| CVE-2024-5191 | branda-white-labeling (WordPress plugin) | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ | medium | 6.4 | 0% |
| CVE-2024-5224 | cardoza-facebook-like-box (WordPress plugin) | The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardoz | medium | 6.4 | 0% |
| CVE-2024-5426 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ p | medium | 6.4 | 0% |
| CVE-2024-5571 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-5646 | futurio-extra (WordPress plugin) | The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’ attribute within the Advanced Text | medium | 6.4 | 0% |
| CVE-2024-9421 | login-logout-shortcode (WordPress plugin) | The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2024-9445 | display-medium-posts (WordPress plugin) | The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_medium_posts shortcode i | medium | 6.4 | 0% |
| CVE-2024-9674 | debrandify (WordPress plugin) | The Debrandify · Remove or Replace WordPress Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads | medium | 6.4 | 0% |
| CVE-2024-32597 | wp-smart-import (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows | medium | 5.9 | 0% |
| CVE-2023-3410 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, | medium | 5.4 | 0% |
| CVE-2024-6283 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL parameter of the De Gallery widge | medium | 5.4 | 0% |
| CVE-2026-54181 | backpack/crud | Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted | medium | 5.4 | 0% |
| CVE-2026-72832 | getgrav/grav | Grav: Stored XSS via quoted-attribute bypass in detectXss | medium | 5.4 | 0% |
| CVE-2025-3502 | wp-maps (WordPress plugin) | The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users suc | medium | 4.8 | 0% |