Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-6540 | web-cam (WordPress plugin) | The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2024-5312 | phpservermon/phpservermon | PHP Server Monitor vulnerable to Cross-site Scripting | medium | 6.3 | 0% |
| CVE-2025-1286 | download-html-tinymce-button (WordPress plugin) | The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page | medium | 6.1 | 0% |
| CVE-2025-70844 | kantorge/yaffa | yaffa vulnerable to Cross Site Scripting | medium | 6.1 | 0% |
| CVE-2024-35621 | getformwork/formwork | formwork Cross-site scripting vulnerability in Markdown fields | medium | 4.8 | 0% |
| CVE-2025-54266 | magento/community-edition, magento/project-community-edition | Magento vulnerable to stored Cross-Site Scripting (XSS) | medium | 4.8 | 0% |
| CVE-2024-49231 | wordpress-video (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cyclop WordPress Video wordpress-video | medium | 6.5 | 0% |
| CVE-2025-2918 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all | medium | 6.4 | 0% |
| CVE-2026-47348 | typo3/cms-core, typo3/cms-indexed-search | TYPO3 CMS has Cross-Site Scripting in Indexed Search | medium | 0.0 | 0% |
| CVE-2026-32734 | baserproject/basercms | baserCMS is Vulnerable to Cross-site Scripting | high | 7.1 | 0% |
| CVE-2024-10847 | storely (WordPress theme) | The Storely theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and includi | medium | 6.4 | 0% |
| CVE-2024-12117 | stackable-ultimate-gutenberg-blocks (WordPress plugin) | The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of | medium | 6.4 | 0% |
| CVE-2025-0837 | puzzles (WordPress theme) | The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.6 due to i | medium | 6.4 | 0% |
| CVE-2025-6234 | hostel (WordPress plugin) | The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 6.1 | 0% |
| CVE-2024-1940 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and inclu | high | 7.1 | 0% |
| CVE-2025-1437 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2025-1526 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget (countdown | medium | 6.4 | 0% |
| CVE-2025-1560 | wow-entrance-effects-wee (WordPress plugin) | The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2025-5337 | ml-slider (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ param | medium | 6.4 | 0% |
| CVE-2024-13422 | seo-blogger-to-wordpress-301-redirector (WordPress plugin) | The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'u | medium | 6.1 | 0% |
| CVE-2024-9230 | powerpress (WordPress plugin) | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a | medium | 5.9 | 0% |
| CVE-2024-11847 | -wp-svg-upload (WordPress plugin), digimix/wp-svg-upload | The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to S | medium | 4.8 | 0% |
| CVE-2024-12872 | zalomeni (WordPress plugin) | The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-13602 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2025-0329 | wpbot (WordPress plugin) | The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2025-0629 | coronavirus-\(covid-19\)-notice-message (WordPress plugin) | The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allo | medium | 4.8 | 0% |
| CVE-2025-0718 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2025-1289 | plugin-oficial (WordPress plugin) | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2025-1619 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2025-1620 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2025-1621 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2026-58657 | getgrav/grav | Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav | medium | 4.8 | 0% |
| CVE-2024-10558 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | 0% |
| CVE-2024-12769 | simple-banner (WordPress plugin) | The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users s | low | 3.5 | 0% |
| CVE-2024-13122 | advanced-form-integration (WordPress plugin) | The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as a | low | 3.5 | 0% |
| CVE-2024-13123 | advanced-form-integration (WordPress plugin) | The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as a | low | 3.5 | 0% |
| CVE-2024-13124 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2024-13615 | social-snap (WordPress plugin) | The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not | low | 3.5 | 0% |
| CVE-2025-1062 | slider\,-gallery\,-and-carousel (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which cou | low | 3.5 | 0% |
| CVE-2025-1452 | favorites (WordPress plugin) | The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such a | low | 3.5 | 0% |
| CVE-2025-1623 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2025-1624 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2024-12708 | bulk-me-now\! (WordPress plugin) | The Bulk Me Now! WordPress plugin through 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a | high | 7.1 | 0% |
| CVE-2025-2929 | order-delivery-date-for-woocommerce (WordPress plugin) | The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leadi | high | 7.1 | 0% |
| CVE-2025-3813 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ paramet | medium | 6.4 | 0% |
| CVE-2025-5144 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions u | medium | 6.4 | 0% |
| CVE-2026-47761 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection | high | 8.7 | 0% |
| CVE-2025-67849 | moodle/moodle | Moodle Cross-site Scripting (XSS) vulnerability | high | 7.3 | 0% |
| CVE-2025-5291 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_ | medium | 6.4 | 0% |
| CVE-2025-5703 | stageshow (WordPress plugin) | The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and includ | medium | 6.4 | 0% |