Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9073 | gtg-advanced-blocks (WordPress plugin) | The GutenGeek Free Gutenberg Blocks for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in | medium | 6.4 | 0% |
| CVE-2024-9848 | product-customizer-light (WordPress plugin) | The Product Customizer Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-35761 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduli | medium | 6.5 | 0% |
| CVE-2024-10150 | bamazoo-button-generator (WordPress plugin) | The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-12452 | ziggeo (WordPress plugin) | The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeo_event' shortcode in all versions up to | medium | 6.4 | 0% |
| CVE-2024-13395 | threepress (WordPress plugin) | The Threepress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'threepress' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-13576 | gumlet-video (WordPress plugin) | The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to | medium | 6.4 | 0% |
| CVE-2024-13757 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_layer shor | medium | 6.4 | 0% |
| CVE-2024-13802 | bandsintown (WordPress plugin) | The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintown_events' shortcode in | medium | 6.4 | 0% |
| CVE-2024-4971 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all ver | medium | 6.4 | 0% |
| CVE-2024-5251 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_pricing shortc | medium | 6.4 | 0% |
| CVE-2024-5252 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shor | medium | 6.4 | 0% |
| CVE-2024-5253 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ult_team shortcode in al | medium | 6.4 | 0% |
| CVE-2024-5254 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_banner sho | medium | 6.4 | 0% |
| CVE-2024-5255 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_dual_color shor | medium | 6.4 | 0% |
| CVE-2024-9064 | inline-svg-elementor (WordPress plugin) | The Elementor Inline SVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2025-1410 | pie-calendar (WordPress plugin) | The Events Calendar Made Simple – Pie Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's piecal sho | medium | 6.4 | 0% |
| CVE-2025-1802 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘marker_title’, 'notif | medium | 6.4 | 0% |
| CVE-2025-2225 | responsive-addons-for-elementor (WordPress plugin) | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cros | medium | 6.4 | 0% |
| CVE-2025-3457 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2025-3458 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2025-62796 | privatebin/privatebin | PrivateBin is missing HTML sanitization of attached filename in file size hint | medium | 5.8 | 0% |
| CVE-2024-10678 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-3288 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attri | medium | 5.4 | 0% |
| CVE-2026-55464 | snipe/snipe-it | Snipe-IT vulnerable to stored XSS via Markdown custom field | medium | 5.4 | 0% |
| CVE-2023-5691 | collectchat (WordPress plugin) | The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insuf | medium | 4.4 | 0% |
| CVE-2026-47730 | twig/twig | Twig: XSS in profiler HtmlDumper via unescaped template and profile names | low | 0.0 | 0% |
| CVE-2024-43125 | wp-table-builder (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Table Builder WP Table Build | medium | 6.5 | 0% |
| CVE-2024-13459 | fusedesk (WordPress plugin) | The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-48228 | funadmin/funadmin | Funadmin Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2025-1625 | qi-blocks (WordPress plugin) | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a pa | medium | 5.4 | 0% |
| CVE-2025-4133 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in | medium | 5.4 | 0% |
| CVE-2024-3977 | wordpress-jitsi-shortcode (WordPress plugin) | The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2025-3503 | wp-maps (WordPress plugin) | The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2026-28426 | statamic/cms | Statamic vulnerable to privilege escalation via stored cross-site scripting | high | 8.7 | 0% |
| CVE-2024-12813 | open-hours (WordPress plugin) | The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current- | medium | 6.4 | 0% |
| CVE-2024-13465 | ablocks (WordPress plugin) | The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, | medium | 6.4 | 0% |
| CVE-2024-13665 | admire-extra (WordPress plugin) | The Admire Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'space' shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2025-3862 | contest-gallery (WordPress plugin) | Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and includin | medium | 6.4 | 0% |
| CVE-2023-6978 | wp-job-manager-companies (WordPress plugin) | The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'company' parameter in al | medium | 6.1 | 0% |
| CVE-2024-13467 | wp-contact-form7-email-spam-blocker (WordPress plugin) | The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all | medium | 6.1 | 0% |
| CVE-2025-63644 | ph7software/ph7builder | pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability | medium | 6.1 | 0% |
| CVE-2024-13734 | card-elements-for-elementor (WordPress plugin) | The Card Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Profile Card widget in al | medium | 6.4 | 0% |
| CVE-2024-6155 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request For | medium | 6.4 | 0% |
| CVE-2024-6261 | final-tiles-grid-gallery-lite (WordPress plugin) | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGalle | medium | 6.4 | 0% |
| CVE-2025-1405 | post-type-x (WordPress plugin) | The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all | medium | 6.4 | 0% |
| CVE-2025-1571 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Imag | medium | 6.4 | 0% |
| CVE-2025-1689 | paypal-checkout (WordPress plugin) | The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in vers | medium | 6.4 | 0% |
| CVE-2025-1690 | stripe-checkout (WordPress plugin) | The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up | medium | 6.4 | 0% |
| CVE-2025-4943 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-lakit-element-link’ | medium | 6.4 | 0% |