Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-36417 | cardoza-3d-tag-cloud (WordPress plugin) | Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress. | medium | 6.1 | 0% |
| CVE-2024-37156 | sulu/form-bundle | TokenController formName not sanitized in hidden input | medium | 6.1 | 0% |
| CVE-2024-12308 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2025-4405 | hot-random-image (WordPress plugin) | The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and i | medium | 4.9 | 0% |
| CVE-2025-0692 | simple-video-management-system (WordPress plugin) | The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high | low | 3.5 | 0% |
| CVE-2025-26528 | moodle/moodle | Moodle has a stored XSS in ddimageortext question type | low | 3.4 | 0% |
| CVE-2021-27917 | mautic/core, mautic/core-lib | Mautic has an XSS in contact tracking and page hits report | high | 7.3 | 0% |
| CVE-2024-13668 | wordpress-activity-o-meter (WordPress plugin) | The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, | high | 7.1 | 0% |
| CVE-2024-3492 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin | medium | 6.4 | 0% |
| CVE-2024-5317 | newsletter (WordPress plugin) | The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and includin | medium | 6.4 | 0% |
| CVE-2025-3100 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2024-3866 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all | medium | 4.7 | 0% |
| CVE-2025-46350 | yeswiki/yeswiki | Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting | low | 3.8 | 0% |
| CVE-2024-11453 | gs-pinterest-portfolio (WordPress plugin) | The WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout plugin for WordPress is vulnerable to Stored Cross-S | medium | 6.4 | 0% |
| CVE-2024-12334 | wc-affiliate (WordPress plugin) | The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any para | medium | 6.1 | 0% |
| CVE-2026-23476 | facturascripts/facturascripts | FacturaScripts is Vulnerable to Reflected XSS | medium | 5.4 | 0% |
| CVE-2024-8660 | concrete5/concrete5 | Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block | medium | 4.8 | 0% |
| CVE-2026-46361 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering | medium | 6.9 | 0% |
| CVE-2025-70958 | intelliants/subrion | Subrion CMS vulnerable to cross-site scripting | medium | 6.1 | 0% |
| CVE-2024-12268 | responsive-block-editor-addons (WordPress plugin) | The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive-blo | medium | 6.4 | 0% |
| CVE-2024-5439 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-10815 | postlists (WordPress plugin) | The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute | medium | 4.2 | 0% |
| CVE-2026-25486 | craftcms/commerce | Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2024-13659 | listamester (WordPress plugin) | The Listamester plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listamester' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2025-27412 | redaxo/source | REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation | medium | 6.1 | 0% |
| CVE-2025-66026 | redaxo/source | REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] | medium | 6.1 | 0% |
| CVE-2025-1033 | badgearoo (WordPress plugin) | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-13901 | counter-box (WordPress plugin) | The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cr | medium | 4.4 | 0% |
| CVE-2024-12683 | smart-maintenance-mode (WordPress plugin) | The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | 0% |
| CVE-2020-37256 | getgrav/grav | Cross-Site Scripting in Grav | medium | 0.0 | 0% |
| CVE-2025-2893 | gutenverse (WordPress plugin) | The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2025-3510 | composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2025-3748 | taxonomy-chain-menu (WordPress plugin) | The Taxonomy Chain Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pn_chain_menu shortcode in all ve | medium | 6.4 | 0% |
| CVE-2025-3858 | formality (WordPress plugin) | The Formality plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and includi | medium | 6.4 | 0% |
| CVE-2025-3890 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' short | medium | 6.4 | 0% |
| CVE-2025-1505 | woocommerce-ajax-filters (WordPress plugin) | The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all vers | medium | 6.1 | 0% |
| CVE-2025-29746 | koillection/koillection | Koillection Cross Site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2026-22254 | winter/wn-cms-module | Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager | low | 0.0 | 0% |
| CVE-2024-12321 | wc-affiliate (WordPress plugin) | The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 0% |
| CVE-2024-13874 | web-push-notifications (WordPress plugin) | The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | high | 7.1 | 0% |
| CVE-2024-13875 | wp-pmanager (WordPress plugin) | The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | high | 7.1 | 0% |
| CVE-2024-13878 | spotbot (WordPress plugin) | The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | high | 7.1 | 0% |
| CVE-2025-1455 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all ve | medium | 6.4 | 0% |
| CVE-2025-1456 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCoun | medium | 6.4 | 0% |
| CVE-2025-2839 | wp-import-export-lite (WordPress plugin) | The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versio | medium | 6.4 | 0% |
| CVE-2025-3077 | betheme (WordPress plugin) | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all v | medium | 6.4 | 0% |
| CVE-2024-11254 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter | medium | 6.1 | 0% |
| CVE-2025-0671 | icegram-express (WordPress plugin) | The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privi | medium | 6.1 | 0% |
| CVE-2026-55409 | filament/forms | Filament: Disabled RichEditor field state can be used for XSS | high | 7.6 | 0% |
| CVE-2024-11731 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider sho | medium | 6.4 | 0% |