Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13649 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in | medium | 6.4 | 0% |
| CVE-2024-13661 | wp-table-editor (WordPress plugin) | The Table Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wptableeditor_vtabs' shortcode in all v | medium | 6.4 | 0% |
| CVE-2024-13805 | file-manager-advanced (WordPress plugin) | The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-S | medium | 6.4 | 0% |
| CVE-2024-9582 | accordion-slider (WordPress plugin) | The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in al | medium | 6.4 | 0% |
| CVE-2025-0169 | dwt-listing (WordPress plugin) | The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, | medium | 6.4 | 0% |
| CVE-2025-1757 | uber-grid (WordPress plugin) | The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfhu | medium | 6.4 | 0% |
| CVE-2025-1783 | gallery-styles (WordPress plugin) | The Gallery Styles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery Block in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2025-2685 | tablepress (WordPress plugin) | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parame | medium | 6.4 | 0% |
| CVE-2025-61674 | october/system | October CMS Vulnerable to Stored XSS via Editor and Branding Styles | medium | 6.1 | 0% |
| CVE-2025-61676 | october/system | October CMS Vulnerable to Stored XSS via Branding Styles | medium | 6.1 | 0% |
| CVE-2024-54775 | dcat/laravel-admin | Dcat-Admin Cross-Site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2024-13574 | xv-random-quotes (WordPress plugin) | The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading t | high | 7.1 | 0% |
| CVE-2024-13836 | wp-login-control (WordPress plugin) | The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 0% |
| CVE-2024-13862 | s3bubble-amazon-web-services-oembed-media-streaming-support (WordPress plugin) | The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a paramet | high | 7.1 | 0% |
| CVE-2024-13863 | stylish-google-sheet-reader (WordPress plugin) | The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the p | high | 7.1 | 0% |
| CVE-2024-13891 | schedule (WordPress plugin) | The Schedule WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | high | 7.1 | 0% |
| CVE-2024-12163 | goodlayers-core (WordPress plugin) | The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads | medium | 6.5 | 0% |
| CVE-2024-4939 | weaverx-theme-support (WordPress plugin) | The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all vers | medium | 6.4 | 0% |
| CVE-2024-5341 | the-plus-addons-for-elementor (WordPress plugin) | The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' attribute of | medium | 6.4 | 0% |
| CVE-2024-9125 | king-ie (WordPress plugin) | The king_IE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 | medium | 6.4 | 0% |
| CVE-2025-5568 | mage-eventpress (WordPress plugin) | The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including | medium | 6.4 | 0% |
| CVE-2024-9775 | anih (WordPress theme) | The Anih - Creative Agency WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versio | medium | 5.5 | 0% |
| CVE-2015-4582 | boot-store (WordPress theme) | The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS. NOTE: CVE-2015-4582 is not | high | 7.2 | 0% |
| CVE-2024-2923 | magical-addons-for-elementor (WordPress plugin) | The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vuln | medium | 6.4 | 0% |
| CVE-2024-5789 | triton-lite (WordPress theme) | The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode | medium | 6.4 | 0% |
| CVE-2024-5869 | neighborly (WordPress theme) | The Neighborly theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode | medium | 6.4 | 0% |
| CVE-2024-5870 | tweaker5 (WordPress theme) | The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in | medium | 6.4 | 0% |
| CVE-2024-5884 | beauty (WordPress theme) | The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tpl_featured_cat_id’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-9373 | elemenda (WordPress plugin) | The Elemenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0. | medium | 6.4 | 0% |
| CVE-2025-6976 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin | medium | 6.4 | 0% |
| CVE-2025-65013 | librenms/librenms | LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name` | medium | 6.2 | 0% |
| CVE-2024-13749 | stafflist (WordPress plugin) | The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to m | medium | 6.1 | 0% |
| CVE-2025-2279 | maps (WordPress plugin) | The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page | medium | 5.9 | 0% |
| CVE-2024-3987 | mobile-menu (WordPress plugin) | The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt tex | medium | 5.4 | 0% |
| CVE-2024-10680 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-13207 | widget-for-social-page-feeds (WordPress plugin) | The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2024-13381 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-13610 | simple-social-buttons (WordPress plugin) | The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow hi | medium | 4.8 | 0% |
| CVE-2024-9882 | salon-booking-system (WordPress plugin) | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and esc | medium | 4.8 | 0% |
| CVE-2025-1453 | category-posts-widget (WordPress plugin) | The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2025-3504 | wp-maps (WordPress plugin) | The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-11924 | icegram-express (WordPress plugin) | The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, w | low | 3.5 | 0% |
| CVE-2024-12273 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privileg | low | 3.5 | 0% |
| CVE-2024-9771 | wp-recall (WordPress plugin) | The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users su | low | 3.5 | 0% |
| CVE-2025-0627 | taxopress (WordPress plugin) | The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, | low | 3.5 | 0% |
| CVE-2025-1523 | ultimate-dashboard (WordPress plugin) | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege us | low | 3.5 | 0% |
| CVE-2025-1524 | ultimate-dashboard (WordPress plugin) | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege us | low | 3.5 | 0% |
| CVE-2025-1525 | ultimate-dashboard (WordPress plugin) | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege us | low | 3.5 | 0% |
| CVE-2025-3514 | sureforms (WordPress plugin) | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2026-32629 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor | medium | 0.0 | 0% |