Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13329 | solidres (WordPress plugin) | The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | high | 7.1 | 0% |
| CVE-2024-13733 | skt-blocks (WordPress plugin) | The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's skt-blocks/ | medium | 6.4 | 0% |
| CVE-2024-13858 | buddyboss-platform (WordPress plugin) | The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ paramete | medium | 6.4 | 0% |
| CVE-2024-9173 | gf-custom-style (WordPress plugin) | The GF Custom Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2025-3488 | wpml (WordPress plugin) | The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_switcher shortcode in versions 3.6 | medium | 6.4 | 0% |
| CVE-2024-13100 | opsi-israel-domestic-shipments (WordPress plugin) | The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the | medium | 6.1 | 0% |
| CVE-2024-10583 | popup-maker (WordPress plugin) | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to St | medium | 5.4 | 0% |
| CVE-2024-13208 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which coul | medium | 4.3 | 0% |
| CVE-2025-64112 | statamic/cms | Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation | high | 8.0 | 0% |
| CVE-2025-6212 | ultimate-addons-for-contact-form-7 (WordPress plugin) | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3. | high | 7.2 | 0% |
| CVE-2024-5265 | wpbakery-page-builder-clipboard (WordPress plugin) | The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link attribute within the vc_single_i | medium | 6.4 | 0% |
| CVE-2024-5938 | boot-store (WordPress theme) | The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode | medium | 6.4 | 0% |
| CVE-2024-9452 | branding (WordPress plugin) | The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1. | medium | 6.4 | 0% |
| CVE-2023-7086 | svg-uploads-support (WordPress plugin) | The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as A | medium | 5.4 | 0% |
| CVE-2023-7088 | inventivo (WordPress plugin) | The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow us | medium | 5.4 | 0% |
| CVE-2024-10151 | auto-iframe (WordPress plugin) | The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-11841 | tithe.ly-giving-button (WordPress plugin) | The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2024-46994 | baserproject/basercms | baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts and Contents list Feature | medium | 5.4 | 0% |
| CVE-2026-45072 | symfony/symfony, symfony/twig-bridge, symfony/web-profiler-bundle | Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering | low | 0.0 | 0% |
| CVE-2024-1328 | newsletter2go (WordPress plugin) | The Newsletter2Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-5867 | delicate (WordPress theme) | The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode i | medium | 6.4 | 0% |
| CVE-2024-7054 | popup-maker (WordPress plugin) | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2025-67850 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | high | 7.3 | 0% |
| CVE-2023-52124 | wp-tabs (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive | medium | 6.5 | 0% |
| CVE-2024-8962 | wpbits-addons-for-elementor (WordPress plugin) | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all v | medium | 6.4 | 0% |
| CVE-2022-3025 | bitcoin\/altcoin-faucet (WordPress plugin) | The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make | medium | 5.4 | 0% |
| CVE-2024-1219 | easy-social-feed (WordPress plugin) | The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.3 | 0% |
| CVE-2022-31114 | backpack/crud | backpack/crud is vulnerable to Cross-Site Scripting (XSS) | medium | 0.0 | 0% |
| CVE-2026-34989 | ci4-cms-erp/ci4ms | CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.0 | 0% |
| CVE-2019-25317 | kimai/kimai | Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions | medium | 6.4 | 0% |
| CVE-2024-12851 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulner | medium | 6.4 | 0% |
| CVE-2024-12852 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' parameter of the Happ | medium | 6.4 | 0% |
| CVE-2025-3614 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a | medium | 6.4 | 0% |
| CVE-2021-24988 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboa | medium | 5.4 | 0% |
| CVE-2024-4353 | concrete5/concrete5 | Concrete CMS vulnerable to Stored Cross-site Scripting | low | 3.1 | 0% |
| CVE-2026-34375 | wwbn/avideo | AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page | high | 8.2 | 0% |
| CVE-2026-33080 | filament/tables | Filament Unvalidated Range and Values summarizer values can be used for XSS | high | 7.3 | 0% |
| CVE-2024-13564 | rife-elementor-extensions (WordPress plugin) | The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Writing Effect | medium | 6.4 | 0% |
| CVE-2024-13565 | simple-map-no-api (WordPress plugin) | The Simple Map No Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-13648 | maps-for-wp (WordPress plugin) | The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2024-13672 | mini-course-generator (WordPress plugin) | The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-6849 | preloader-plus (WordPress plugin) | The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads | medium | 6.4 | 0% |
| CVE-2025-0371 | jetelements (WordPress plugin) | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2025-0805 | mortgage-loan-calculator (WordPress plugin) | The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortc | medium | 6.4 | 0% |
| CVE-2025-1287 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2025-1406 | newpost-catch (WordPress plugin) | The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, an | medium | 6.4 | 0% |
| CVE-2025-1489 | wp-appbox (WordPress plugin) | The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and | medium | 6.4 | 0% |
| CVE-2025-5341 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2024-13825 | email-keep (WordPress plugin) | The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | medium | 6.1 | 0% |
| CVE-2025-0613 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, | medium | 6.1 | 0% |