Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10867 | borderless (WordPress plugin) | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site | medium | 5.4 | 0% |
| CVE-2023-6446 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and i | medium | 4.4 | 0% |
| CVE-2023-6497 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting | medium | 4.4 | 0% |
| CVE-2024-0657 | internal-links (WordPress plugin) | The Internal Link Juicer: SEO Auto Linker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings | medium | 4.4 | 0% |
| CVE-2024-0664 | meks-smart-social-widget (WordPress plugin) | The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meks Smart Social Widget in all versi | medium | 4.4 | 0% |
| CVE-2024-0688 | pubsubhubbub (WordPress plugin) | The "WebSub (FKA. PubSubHubbub)" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to | medium | 4.4 | 0% |
| CVE-2024-0703 | sticky-buttons (WordPress plugin) | The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versi | medium | 4.4 | 0% |
| CVE-2026-26188 | solspace/craft-freeform | Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue | low | 0.0 | 0% |
| CVE-2026-42611 | getgrav/grav | Grav is Vulnerable to Stored XSS via Tag Injection | high | 8.9 | 0% |
| CVE-2025-66468 | aimeos/ai-cms-grapesjs | Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors | high | 7.6 | 0% |
| CVE-2026-25488 | craftcms/commerce | Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2024-12525 | easy-mls-listings-import (WordPress plugin) | The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' | medium | 6.4 | 0% |
| CVE-2024-13464 | library-bookshelves (WordPress plugin) | The Library Bookshelves plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bookshelf' shortcode in all vers | medium | 6.4 | 0% |
| CVE-2024-13658 | ngg-smart-image-search (WordPress plugin) | The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' sho | medium | 6.4 | 0% |
| CVE-2024-13679 | buybox-widget (WordPress plugin) | The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-13769 | puzzles (WordPress plugin) | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to | medium | 6.4 | 0% |
| CVE-2024-5641 | one-click-order-reorder (WordPress plugin) | The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th | medium | 6.4 | 0% |
| CVE-2024-5668 | foobox-image-lightbox (WordPress plugin) | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML da | medium | 6.4 | 0% |
| CVE-2024-9595 | tablepress (WordPress plugin) | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content | medium | 6.4 | 0% |
| CVE-2024-13319 | themify-builder (WordPress plugin) | The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-13404 | link-library (WordPress plugin) | The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, an | medium | 6.1 | 0% |
| CVE-2024-13406 | xml-for-google-merchant-center (WordPress plugin) | The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all v | medium | 6.1 | 0% |
| CVE-2025-61183 | webreinvent/vaahcms | VaahCMS is vulnerable to XSS through its Avatar Upload endpoint | medium | 6.1 | 0% |
| CVE-2024-5091 | skt-addons-for-elementor (WordPress plugin) | The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Age Gate and Creative Slider | high | 7.4 | 0% |
| CVE-2025-2800 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | high | 7.2 | 0% |
| CVE-2024-5090 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SiteOrigin Blog Widget in a | medium | 6.4 | 0% |
| CVE-2025-6975 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ca | medium | 6.1 | 0% |
| CVE-2025-30148 | silverstripe/framework | Silverstripe Framework has a XSS vulnerability in HTML editor | medium | 5.4 | 0% |
| CVE-2026-82396 | sulu/sulu | Sulu: Stored XSS via media download inline-disposition override | medium | 5.4 | 0% |
| CVE-2024-45612 | contao/core-bundle | Contao affected by insert tag injection via canonical URL | medium | 5.3 | 0% |
| CVE-2023-6487 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions | medium | 4.4 | 0% |
| CVE-2026-44655 | mantisbt/mantisbt | MantisBT has Stored XSS on Move Attachments Admin Page | high | 0.0 | 0% |
| CVE-2024-12118 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the htm | medium | 6.4 | 0% |
| CVE-2025-2892 | all-in-one-seo (WordPress plugin) | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 6.4 | 0% |
| CVE-2025-3487 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2024-12807 | social-share-buttons (WordPress plugin) | The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-6254 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This | medium | 4.3 | 0% |
| CVE-2025-1203 | slider\,-gallery\,-and-carousel (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which cou | low | 3.5 | 0% |
| CVE-2026-25484 | craftcms/commerce | Craft Commerce has Stored XSS in Product Type Name | medium | 0.0 | 0% |
| CVE-2026-25485 | craftcms/composer | Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-25487 | craftcms/commerce | Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-25490 | craftcms/commerce | Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-25522 | craftcms/commerce | Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2025-2325 | wp-test-email (WordPress plugin) | The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1 | high | 7.2 | 0% |
| CVE-2024-10266 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all | medium | 6.4 | 0% |
| CVE-2024-10484 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in | medium | 6.4 | 0% |
| CVE-2024-10885 | searchiq (WordPress plugin) | The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortc | medium | 6.4 | 0% |
| CVE-2024-11782 | wp-mailster (WordPress plugin) | The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mst_subscribe' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-11897 | mightyforms (WordPress plugin) | The Contact Form, Survey & Form Builder – MightyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mi | medium | 6.4 | 0% |
| CVE-2024-11898 | scratch-win-giveaways-for-website-facebook (WordPress plugin) | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vu | medium | 6.4 | 0% |