Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-1665 | avada-builder (WordPress plugin) | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all v | medium | 6.4 | 0% |
| CVE-2026-34716 | wwbn/avideo | AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification | medium | 6.4 | 0% |
| CVE-2026-24415 | devcode-it/openstamanager | OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter | medium | 0.0 | 0% |
| CVE-2024-11826 | quillforms (WordPress plugin) | The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on W | medium | 6.4 | 0% |
| CVE-2024-3714 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gi | medium | 6.4 | 0% |
| CVE-2025-0433 | master-addons (WordPress plugin) | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnera | medium | 6.4 | 0% |
| CVE-2025-0512 | structured-content (WordPress plugin) | The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_busine | medium | 6.4 | 0% |
| CVE-2026-77607 | mediawiki/semantic-media-wiki | Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS | medium | 6.1 | 0% |
| CVE-2026-77608 | mediawiki/semantic-media-wiki | Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) | medium | 6.1 | 0% |
| CVE-2026-77610 | mediawiki/semantic-media-wiki | Semantic MediaWiki has a query debug output XSS (`DebugFormatter`) | medium | 6.1 | 0% |
| CVE-2024-3887 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Form Builder widget in al | medium | 5.4 | 0% |
| CVE-2018-25157 | phraseanet/phraseanet | Phraseanet vulnerable to stored cross-site scripting through crafted file names | medium | 6.4 | 0% |
| CVE-2024-13859 | buddyboss-platform (WordPress plugin) | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in al | medium | 6.4 | 0% |
| CVE-2024-13860 | buddyboss-platform (WordPress plugin) | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions | medium | 6.4 | 0% |
| CVE-2024-5533 | divi (WordPress theme) | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient i | medium | 6.4 | 0% |
| CVE-2025-3878 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify | medium | 6.4 | 0% |
| CVE-2025-5236 | ninjateam-telegram (WordPress plugin) | The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versio | medium | 6.4 | 0% |
| CVE-2026-47344 | typo3/html-sanitizer | TYPO3 HTML Sanitizer allows Cross-site Scripting | low | 0.0 | 0% |
| CVE-2026-47759 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes | high | 8.7 | 0% |
| CVE-2026-47762 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments | high | 8.7 | 0% |
| CVE-2025-4594 | tournamatch (WordPress plugin) | The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcod | medium | 6.4 | 0% |
| CVE-2026-23643 | cakephp/cakephp | CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting | medium | 5.4 | 0% |
| CVE-2024-5473 | simple-photoswipe (WordPress plugin) | The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.0 | 0% |
| CVE-2026-41897 | mantisbt/mantisbt | MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field | medium | 0.0 | 0% |
| CVE-2025-1513 | contest-gallery (WordPress plugin) | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Bu | high | 7.2 | 0% |
| CVE-2025-62414 | bagisto/bagisto | bagisto has Cross Site Scripting (XSS) in Create New Customer | medium | 6.9 | 0% |
| CVE-2025-62415 | bagisto/bagisto | bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML) | medium | 6.9 | 0% |
| CVE-2025-62418 | bagisto/bagisto | bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG) | medium | 6.9 | 0% |
| CVE-2024-10000 | learning-management-system (WordPress plugin) | The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2025-4127 | wp-seo-structured-data-schema (WordPress plugin) | The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Price Range’ parameter in all v | medium | 6.4 | 0% |
| CVE-2024-13867 | listivo (WordPress theme) | The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in al | medium | 6.1 | 0% |
| CVE-2025-4429 | gearside-developer-dashboard (WordPress plugin) | The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the p | medium | 6.1 | 0% |
| CVE-2024-12120 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_ | medium | 5.4 | 0% |
| CVE-2025-68951 | thorsten/phpmyfaq | phpMyFAQ has Stored XSS in user list via admin-managed display_name | medium | 5.4 | 0% |
| CVE-2024-8488 | survey-maker (WordPress plugin) | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4 | medium | 4.4 | 0% |
| CVE-2024-37519 | premium-blocks-for-gutenburg (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Bloc | medium | 6.5 | 0% |
| CVE-2024-10715 | mappress-google-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map block in all versions | medium | 6.4 | 0% |
| CVE-2024-13445 | elementor (WordPress plugin) | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bord | medium | 6.4 | 0% |
| CVE-2024-3513 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag (postTitle | medium | 6.4 | 0% |
| CVE-2024-4473 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-4581 | slider-revolution (WordPress plugin) | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-4705 | testimonials-widget (WordPress plugin) | The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all ver | medium | 6.4 | 0% |
| CVE-2024-7629 | responsive-video (WordPress plugin) | The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versi | medium | 6.4 | 0% |
| CVE-2024-8627 | ultimate-tinymce (WordPress plugin) | The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-8723 | 012-ps-multi-languages (WordPress plugin) | The 012 Ps Multi Languages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via translated titles in all versions up to, an | medium | 6.4 | 0% |
| CVE-2024-9366 | easy-menu-manager-wpzest (WordPress plugin) | The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-9703 | arconix-shortcodes (WordPress plugin) | The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2025-1064 | easy-login-woocommerce (WordPress plugin) | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_ | medium | 6.4 | 0% |
| CVE-2024-10703 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could all | medium | 6.1 | 0% |
| CVE-2024-11272 | pirate-forms (WordPress plugin) | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, | medium | 6.1 | 0% |