Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6722 | chatbot-support-ai (WordPress plugin) | The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its se | medium | 4.8 | 0% |
| CVE-2025-2524 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-9769 | video-gallery (WordPress plugin) | The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in a | medium | 4.4 | 0% |
| CVE-2023-52083 | winter/wn-system-module | Winter CMS Stored XSS through privileged upload of Media Manager file followed by renaming | low | 2.0 | 0% |
| CVE-2025-59839 | starcitizenwiki/embedvideo | Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes | high | 8.6 | 0% |
| CVE-2023-51404 | my-agile-privacy (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyAgilePrivacy My Agile Privacy – The | medium | 6.5 | 0% |
| CVE-2023-51532 | icegram-engage (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lea | medium | 6.5 | 0% |
| CVE-2024-24713 | auto-listings (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Auto Listings Auto Listings – Car L | medium | 6.5 | 0% |
| CVE-2024-5344 | the-plus-addons-for-elementor (WordPress plugin) | The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attr | medium | 6.1 | 0% |
| CVE-2023-51372 | hashbar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HashBar – WordPress Notifica | medium | 5.9 | 0% |
| CVE-2023-50824 | insert-or-embed-articulate-content (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Batt Insert or Embed Articulate | medium | 6.5 | 0% |
| CVE-2025-6550 | the-pack-addon (WordPress plugin) | The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all ver | medium | 6.4 | 0% |
| CVE-2024-10076 | jetpack (WordPress plugin), jetpack-boost (WordPress plugin) | The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when sw | medium | 5.9 | 0% |
| CVE-2022-1112 | autolinks (WordPress plugin) | The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as | medium | 5.4 | 0% |
| CVE-2025-25197 | dnadesign/silverstripe-elemental | Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report | medium | 5.4 | 0% |
| CVE-2025-3583 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-2179 | concrete5/concrete5 | Concrete CMS Stored Cross-site Scripting vulnerability | low | 2.2 | 0% |
| CVE-2023-52084 | winter/wn-backend-module | Winter CMS Stored XSS through Backend ColorPicker FormWidget | low | 2.0 | 0% |
| CVE-2024-5791 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'w | high | 7.2 | 0% |
| CVE-2024-37262 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita.Com Online Booking & Sche | high | 7.1 | 0% |
| CVE-2024-12494 | bmlt-meeting-map (WordPress plugin) | The BMLT Meeting Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmlt_meeting_map' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-13349 | stockdio-historical-chart (WordPress plugin) | The Stockdio Historical Chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stockdio-historical-chart' | medium | 6.4 | 0% |
| CVE-2024-13379 | c9-admin-dashboard (WordPress plugin) | The C9 Admin Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-13441 | bilingual-linker (WordPress plugin) | The Bilingual Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bl_otherlang_link_1 parameter in all versions | medium | 6.4 | 0% |
| CVE-2024-13470 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu | medium | 6.4 | 0% |
| CVE-2024-13548 | power-ups-for-elementor (WordPress plugin) | The Power Ups for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'magic-button' shortcode in a | medium | 6.4 | 0% |
| CVE-2024-13563 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all vers | medium | 6.4 | 0% |
| CVE-2024-13583 | simple-gallery-with-filter (WordPress plugin) | The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2tw_sgwf' shortcode in a | medium | 6.4 | 0% |
| CVE-2024-13612 | bp-better-messages (WordPress plugin) | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 0% |
| CVE-2024-2695 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2024-2861 | wp-user-avatar (WordPress plugin) | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-6432 | custom-post-widget (WordPress plugin) | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within | medium | 6.4 | 0% |
| CVE-2025-0897 | modal-window (WordPress plugin) | The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' | medium | 6.4 | 0% |
| CVE-2023-6987 | string-locator (WordPress plugin) | The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to | medium | 6.1 | 0% |
| CVE-2024-5889 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘co | medium | 6.1 | 0% |
| CVE-2025-6740 | contact-form-cfdb7 (WordPress plugin) | The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions | medium | 6.1 | 0% |
| CVE-2025-70791 | microweber/microweber | Microweber has a Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2024-2310 | wp-google-review-slider (WordPress plugin) | The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 5.9 | 0% |
| CVE-2024-13849 | cookie-notice-bar (WordPress plugin) | The Cookie Notice Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.0 due to i | medium | 5.5 | 0% |
| CVE-2024-13850 | simple-add-pages-or-posts (WordPress plugin) | The Simple add pages or posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.0 | medium | 5.5 | 0% |
| CVE-2024-47050 | mautic/core, mautic/core-lib | Mautic vulnerable to XSS in contact/company tracking (no authentication) | medium | 5.4 | 0% |
| CVE-2024-13482 | icegram-engage (WordPress plugin) | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-5542 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | high | 7.2 | 0% |
| CVE-2024-13735 | hurrytimer (WordPress plugin) | The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | medium | 6.4 | 0% |
| CVE-2024-41380 | microweber/microweber | Microweber Cross Site Scripting (XSS) vulnerability | medium | 6.1 | 0% |
| CVE-2024-41381 | microweber/microweber | Microweber Cross Site Scripting (XSS) vulnerability | medium | 6.1 | 0% |
| CVE-2024-5859 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the | medium | 6.1 | 0% |
| CVE-2024-8729 | easy-social-share-buttons (WordPress plugin) | The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without a | medium | 6.1 | 0% |
| CVE-2024-4477 | wp-logs-book (WordPress plugin) | The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin da | medium | 5.4 | 0% |
| CVE-2025-13784 | yungifez/skuul | yungifez Skuul School Management System vulnerable to XSS via SVG | low | 2.4 | 0% |