Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-4175 | aureuserp/aureuserp | Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler | low | 3.5 | 0% |
| CVE-2026-27568 | wwbn/avideo | AVideo has Stored Cross-Site Scripting via Markdown Comment Injection | medium | 0.0 | 0% |
| CVE-2024-0627 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all | medium | 6.4 | 0% |
| CVE-2024-10310 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-1056 | funnel-builder (WordPress plugin) | The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' functi | medium | 6.4 | 0% |
| CVE-2024-1815 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Gallery bl | medium | 6.4 | 0% |
| CVE-2024-1988 | post-grid (WordPress plugin) | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-2254 | rt-easy-builder-advanced-addons-for-elementor (WordPress plugin) | The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widge | medium | 6.4 | 0% |
| CVE-2024-2784 | the-plus-addons-for-elementor (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Hover Card widget in all version | medium | 6.4 | 0% |
| CVE-2024-3896 | robo-gallery (WordPress plugin) | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the Gallery | medium | 6.4 | 0% |
| CVE-2024-3998 | betheme (WordPress plugin) | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-4001 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in | medium | 6.4 | 0% |
| CVE-2024-4042 | post-grid (WordPress plugin) | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-4208 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-4281 | link-library (WordPress plugin) | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-4366 | spectra (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘block_id’ parameter in v | medium | 6.4 | 0% |
| CVE-2024-4400 | post-and-page-builder (WordPress plugin) | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plguin for WordPress is vulnerable to Stored Cross-Site Scripting via an | medium | 6.4 | 0% |
| CVE-2024-4451 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode i | medium | 6.4 | 0% |
| CVE-2024-4452 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and includi | medium | 6.4 | 0% |
| CVE-2024-4637 | slider-revolution (WordPress plugin) | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to | medium | 6.4 | 0% |
| CVE-2024-4703 | one-page-express-companion (WordPress plugin) | The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_f | medium | 6.4 | 0% |
| CVE-2024-4943 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘has_field_link_rel’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-5025 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arglist’ parameter in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-5061 | enfold (WordPress theme) | The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and 'cl | medium | 6.4 | 0% |
| CVE-2024-5086 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable t | medium | 6.4 | 0% |
| CVE-2024-5173 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget se | medium | 6.4 | 0% |
| CVE-2024-5263 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all | medium | 6.4 | 0% |
| CVE-2024-5330 | breakdance (WordPress plugin) | The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the breakdance_css_file_paths_cache parameter in all ve | medium | 6.4 | 0% |
| CVE-2024-5332 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all ver | medium | 6.4 | 0% |
| CVE-2024-5583 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-5612 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_lightbox_open_btn_ico | medium | 6.4 | 0% |
| CVE-2024-5708 | wpbakery-page-builder (WordPress plugin) | The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up t | medium | 6.4 | 0% |
| CVE-2024-5818 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazi | medium | 6.4 | 0% |
| CVE-2024-5819 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-7064 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-7144 | jetelements (WordPress plugin) | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up | medium | 6.4 | 0% |
| CVE-2024-8325 | blockspare (WordPress plugin) | The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & | medium | 6.4 | 0% |
| CVE-2024-8543 | slider-comparison-image-before-and-after (WordPress plugin) | The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [sciba] shor | medium | 6.4 | 0% |
| CVE-2024-8804 | simple-embed-code (WordPress plugin) | The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions | medium | 6.4 | 0% |
| CVE-2024-9066 | marketing-and-seo-booster (WordPress plugin) | The Marketing and SEO Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-9074 | advanced-blocks-pro (WordPress plugin) | The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and in | medium | 6.4 | 0% |
| CVE-2024-9368 | aggregator-advanced-settings (WordPress plugin) | The Aggregator Advanced Settings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up t | medium | 6.4 | 0% |
| CVE-2024-9372 | wp-blocks-hub (WordPress plugin) | The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includin | medium | 6.4 | 0% |
| CVE-2024-9696 | rescue-shortcodes (WordPress plugin) | The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rescue_tab' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-9704 | dvk-social-sharing (WordPress plugin) | The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortc | medium | 6.4 | 0% |
| CVE-2025-7046 | portfolio-elementor (WordPress plugin) | The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS | medium | 6.4 | 0% |
| CVE-2026-77606 | mediawiki/semantic-media-wiki | Semantic MediaWiki has reflected XSS in Special:Ask plain table headers | medium | 6.1 | 0% |
| CVE-2024-37239 | branda (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress P | medium | 5.9 | 0% |
| CVE-2026-27016 | librenms/librenms | LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags() | medium | 5.4 | 0% |
| CVE-2026-54720 | silverstripe/framework | Silverstripe Framework: Possible XSS attack through media embed | medium | 5.4 | 0% |