Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-3513 | sureforms (WordPress plugin) | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2025-54476 | joomla/filter | Joomla! CMS vulnerable to XSS via the input filter | medium | 0.0 | 0% |
| CVE-2023-6801 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store | medium | 6.4 | 0% |
| CVE-2023-7069 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2024-2130 | cww-companion (WordPress plugin) | The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2024-8747 | email-obfuscate-shortcode (WordPress plugin) | The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode | medium | 6.4 | 0% |
| CVE-2024-8965 | absolute-reviews (WordPress plugin) | The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all | medium | 6.4 | 0% |
| CVE-2024-9115 | common-tools-for-site (WordPress plugin) | The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-9117 | mapplic-lite (WordPress plugin) | The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including | medium | 6.4 | 0% |
| CVE-2025-2541 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2022-0402 | super-forms (WordPress plugin) | The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana param | medium | 6.1 | 0% |
| CVE-2025-3516 | simple-lightbox (WordPress plugin) | The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/ | medium | 5.9 | 0% |
| CVE-2023-6842 | formidable (WordPress plugin) | The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stor | medium | 4.4 | 0% |
| CVE-2026-34564 | ci4-cms-erp/ci4ms | CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2023-6938 | oxygen (WordPress plugin) | The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including | medium | 6.4 | 0% |
| CVE-2024-9457 | cssjockey-add-ons (WordPress plugin) | The WP Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2025-4968 | page-builder (WordPress plugin) | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements | medium | 6.4 | 0% |
| CVE-2024-12167 | ultimate-shortcodes-creator (WordPress plugin) | The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in | medium | 6.1 | 0% |
| CVE-2025-26159 | nasirkhan/laravel-starter | Laravel Starter Cross Site Scripting (XSS) | medium | 6.1 | 0% |
| CVE-2023-6990 | weaver-xtreme-theme-support (WordPress theme) | The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including | medium | 5.4 | 0% |
| CVE-2024-2430 | website-content-in-page-or-post (WordPress plugin) | The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before | medium | 5.4 | 0% |
| CVE-2024-3236 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such | medium | 5.4 | 0% |
| CVE-2024-4270 | svgmagic (WordPress plugin) | The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the author role to SVG with | medium | 5.4 | 0% |
| CVE-2024-5444 | bible-text (WordPress plugin) | The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-5627 | tournamatch (WordPress plugin) | The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as su | medium | 5.4 | 0% |
| CVE-2023-7168 | better-flow-button-for-jetpack (WordPress plugin) | The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2024-10893 | wp-booking-calendar (WordPress plugin) | The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-12566 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could all | medium | 4.8 | 0% |
| CVE-2024-12567 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could | medium | 4.8 | 0% |
| CVE-2024-12568 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which c | medium | 4.8 | 0% |
| CVE-2024-6462 | dl-yandex-metrika (WordPress plugin) | The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-6693 | wp-content-copy-protection-\&-no-right-click (WordPress plugin) | The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-6797 | dl-robots.txt (WordPress plugin) | The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-6798 | dl-verification (WordPress plugin) | The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2024-8187 | smart-post-show (WordPress plugin) | The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-8702 | backup-database (WordPress plugin) | The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2024-4271 | svgator (WordPress plugin) | The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG wi | medium | 4.6 | 0% |
| CVE-2025-10909 | novosga/novosga | Mangati NovoSGA XSS vulnerability in /admin | low | 2.4 | 0% |
| CVE-2026-49216 | symfony/ux-autocomplete | symfony/ux-autocomplete: XSS via unescaped AJAX response data | medium | 0.0 | 0% |
| CVE-2024-13551 | abc-notation (WordPress plugin) | The ABC Notation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abcjs' shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-6495 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in | medium | 6.4 | 0% |
| CVE-2024-12586 | chalet-montagne.com-tools (WordPress plugin) | The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 0% |
| CVE-2025-2077 | simple-amazon-affiliate (WordPress plugin) | The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up | medium | 6.1 | 0% |
| CVE-2025-3057 | drupal/core | Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Sc | medium | 6.1 | 0% |
| CVE-2025-70792 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2024-5417 | gutentor (WordPress plugin) | The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/pos | medium | 5.4 | 0% |
| CVE-2024-10551 | sticky-social-icons (WordPress plugin) | The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-3282 | wp-table-builder (WordPress plugin) | The WP Table Builder WordPress plugin through 1.5.0 does not sanitise and escape some of its Table data, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-3635 | the-post-grid (WordPress plugin) | The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-6481 | search-\&-filter (WordPress plugin) | The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |