Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-11273 | contact-form (WordPress plugin) | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, | medium | 6.1 | 0% |
| CVE-2024-11503 | wp-tabs (WordPress plugin) | The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 6.1 | 0% |
| CVE-2024-12682 | smart-maintenance-mode (WordPress plugin) | The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege | medium | 6.1 | 0% |
| CVE-2024-12723 | infility-global (WordPress plugin) | The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 0% |
| CVE-2024-3814 | tagdiv-composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to | medium | 5.5 | 0% |
| CVE-2024-3815 | newspaper (WordPress theme) | The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up to | medium | 5.5 | 0% |
| CVE-2024-9169 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and i | medium | 5.5 | 0% |
| CVE-2024-8628 | mailoptin (WordPress plugin) | The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to Stored Cross-Site | medium | 5.4 | 0% |
| CVE-2024-9867 | element-pack (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 5.4 | 0% |
| CVE-2024-9868 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 5.4 | 0% |
| CVE-2024-9888 | elementinvader-addons-for-elementor (WordPress plugin) | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widg | medium | 5.4 | 0% |
| CVE-2024-1341 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all vers | medium | 4.9 | 0% |
| CVE-2026-34562 | ci4-cms-erp/ci4ms | CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Store | medium | 4.7 | 0% |
| CVE-2025-0554 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 | medium | 4.4 | 0% |
| CVE-2024-3827 | spectra (WordPress plugin) | The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 | medium | 6.4 | 0% |
| CVE-2025-5678 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-9589 | wp-custom-taxonomy-meta (WordPress plugin) | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in | medium | 5.5 | 0% |
| CVE-2024-9590 | wp-custom-taxonomy-meta (WordPress plugin) | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in th | medium | 5.5 | 0% |
| CVE-2024-9591 | wp-custom-taxonomy-image (WordPress plugin) | The Category and Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_category_image' parameter in ver | medium | 5.5 | 0% |
| CVE-2026-107845 | contao/comments-bundle | Contao: Cross-site scripting in the comments bundle | critical | 9.3 | 0% |
| CVE-2024-10891 | save-as-pdf-by-pdfcrowd (WordPress plugin) | The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'save_as_pdf_pdfcrowd' | medium | 6.4 | 0% |
| CVE-2025-4099 | list-children (WordPress plugin) | The List Children plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list_children' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-13876 | meintopf (WordPress plugin) | The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | high | 7.1 | 0% |
| CVE-2024-13877 | passbeemedia-web-push-notification (WordPress plugin) | The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in | high | 7.1 | 0% |
| CVE-2024-13880 | my-quota (WordPress plugin) | The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | high | 7.1 | 0% |
| CVE-2024-13881 | linkmyposts (WordPress plugin) | The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | high | 7.1 | 0% |
| CVE-2024-37556 | wordpress-notification-bar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd WordPress Notification | medium | 5.9 | 0% |
| CVE-2025-62412 | librenms/librenms | LibreNMS alert-rules has a Cross-Site Scripting Vulnerability | low | 3.8 | 0% |
| CVE-2025-49137 | elmsln/haxcms | Hax CMS Stored Cross-Site Scripting vulnerability | high | 8.5 | 0% |
| CVE-2026-33673 | prestashop/prestashop | PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables | high | 7.6 | 0% |
| CVE-2025-1450 | chaty (WordPress plugin) | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for Wo | medium | 6.4 | 0% |
| CVE-2025-2330 | widgetkit-for-elementor (WordPress plugin) | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+m | medium | 6.4 | 0% |
| CVE-2021-36855 | booking-ultra-pro (WordPress plugin) | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress. | medium | 6.1 | 0% |
| CVE-2023-51506 | wordpress-currency-switcher (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency S | medium | 5.5 | 0% |
| CVE-2026-26989 | librenms/librenms | LibreNMS has a Stored XSS in Alert Rule | medium | 4.3 | 0% |
| CVE-2026-34563 | ci4-cms-erp/ci4ms | CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS | critical | 9.9 | 0% |
| CVE-2026-34565 | ci4-cms-erp/ci4ms | CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-34566 | ci4-cms-erp/ci4ms | CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-34567 | ci4-cms-erp/ci4ms | CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2024-13773 | civi (WordPress plugin) | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver | high | 7.3 | 0% |
| CVE-2024-12400 | tour-master (WordPress plugin) | The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross | high | 7.1 | 0% |
| CVE-2024-13884 | limit-bio (WordPress plugin) | The Limit Bio WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | high | 7.1 | 0% |
| CVE-2024-13885 | wp-e-customers-beta (WordPress plugin) | The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leadi | high | 7.1 | 0% |
| CVE-2025-1401 | wp-click-info (WordPress plugin) | The WP Click Info WordPress plugin through 2.7.4 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 0% |
| CVE-2025-1486 | wowpth (WordPress plugin) | The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect | high | 7.1 | 0% |
| CVE-2025-1487 | wowpth (WordPress plugin) | The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect | high | 7.1 | 0% |
| CVE-2024-11180 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_count | medium | 6.4 | 0% |
| CVE-2024-12119 | foogallery (WordPress plugin) | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Si | medium | 6.4 | 0% |
| CVE-2024-12444 | wp-dispensary (WordPress plugin) | The WP Dispensary plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpd_menu' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-12451 | html5-chat (WordPress plugin) | The HTML5 chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'HTML5CHAT' shortcode in all versions up t | medium | 6.4 | 0% |