Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6495 | yet-another-related-posts-plugin (WordPress plugin) | The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ver | medium | 4.4 | 0% |
| CVE-2024-4942 | custom-dash (WordPress plugin) | The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1 | medium | 4.4 | 0% |
| CVE-2024-25637 | october/system | October System module has a Reflected XSS via X-October-Request-Handler Header | low | 3.1 | 0% |
| CVE-2026-45270 | ci4-cms-erp/ci4ms | CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule | high | 8.7 | 0% |
| CVE-2025-0321 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter in all versions up t | medium | 6.4 | 0% |
| CVE-2025-31679 | drupal/ignition | This module enables you to render error pages using the Ignition package. The module disables certain Drupal core code | medium | 6.1 | 0% |
| CVE-2025-31687 | drupal/spamspan | This module enables your site to obfuscate Email addresses and prevent spambots to collect them. The module doesn't san | medium | 6.1 | 0% |
| CVE-2025-31695 | drupal/link_field_display_mode_formatter | This module adds a formatter for link fields that displays the current entity with another view mode inside the link. D | medium | 6.1 | 0% |
| CVE-2025-31696 | drupal/rapidoc_elements_field_formatter | This module can be used to render Open API Documentation using the RapiDoc library. The module provides a custom formatt | medium | 6.1 | 0% |
| CVE-2025-31697 | drupal/formatter_suite | Formatter Suite provides a suite of field formatters to help present numbers, dates, times, text, links, entity referenc | medium | 6.1 | 0% |
| CVE-2024-10309 | tracking-code-manager (WordPress plugin) | The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the | medium | 5.9 | 0% |
| CVE-2025-3201 | kali-forms (WordPress plugin) | The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, wh | medium | 5.9 | 0% |
| CVE-2025-1454 | ninja-pages (WordPress plugin) | The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 5.4 | 0% |
| CVE-2024-6225 | ameliabooking (WordPress plugin) | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settin | medium | 4.4 | 0% |
| CVE-2025-4783 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of the Countdow | medium | 6.4 | 0% |
| CVE-2025-59712 | snipe/snipe-it | Snipe-IT allows XSS | medium | 6.4 | 0% |
| CVE-2025-6252 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, | medium | 6.4 | 0% |
| CVE-2026-35539 | roundcube/roundcubemail | Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode | medium | 6.1 | 0% |
| CVE-2026-54179 | backpack/crud | Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk | medium | 4.4 | 0% |
| CVE-2026-72787 | craftcms/cms | Craft CMS: Stored XSS in the control panel via unescaped draft name | medium | 0.0 | 0% |
| CVE-2024-12589 | finale-woocommerce-sales-countdown-timer-discount (WordPress plugin) | The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2025-1527 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2025-2560 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2025-2561 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2026-42224 | ipl/web | ipl/web is vulnerable to reflected XSS by malformed search requests | high | 7.6 | 0% |
| CVE-2025-3662 | fancybox (WordPress plugin) | The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' capti | medium | 6.1 | 0% |
| CVE-2025-28010 | modx/revolution | MODX allows cross-site scripting (XSS) via an SVG file | medium | 5.4 | 0% |
| CVE-2025-63520 | feehi/feehicms | FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function | medium | 6.1 | 0% |
| CVE-2024-13505 | survey-maker (WordPress plugin) | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter | medium | 5.5 | 0% |
| CVE-2025-3581 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/ | medium | 4.8 | 0% |
| CVE-2025-3582 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2025-9111 | wpbot (WordPress plugin) | The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privil | low | 3.5 | 0% |
| CVE-2025-30166 | pimcore/admin-ui-classic-bundle | Pimcore's Admin Classic Bundle allows HTML Injection | low | 0.0 | 0% |
| CVE-2023-6745 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-10148 | wp-awesome-buttons (WordPress plugin) | The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-10538 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the before_label parameter in the Image | medium | 6.4 | 0% |
| CVE-2024-1134 | wp-seopress (WordPress plugin) | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as | medium | 6.4 | 0% |
| CVE-2024-11384 | arena.im (WordPress plugin) | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenab | medium | 6.4 | 0% |
| CVE-2024-12073 | meteor-slides (WordPress plugin) | The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_url_value' parameter in all versions up t | medium | 6.4 | 0% |
| CVE-2024-12588 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff w | medium | 6.4 | 0% |
| CVE-2024-12624 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget | medium | 6.4 | 0% |
| CVE-2024-1332 | custom-fonts (WordPress plugin) | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all vers | medium | 6.4 | 0% |
| CVE-2024-1768 | clever-fox (WordPress plugin) | The Clever Fox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's info box block in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-1814 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial bloc | medium | 6.4 | 0% |
| CVE-2024-2772 | contact-form (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 6.4 | 0% |
| CVE-2024-3066 | elegant-addons-for-elementor (WordPress plugin) | The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions | medium | 6.4 | 0% |
| CVE-2024-3134 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 0% |
| CVE-2024-3648 | sharethis-share-buttons (WordPress plugin) | The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' sho | medium | 6.4 | 0% |
| CVE-2024-3997 | prime-slider (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-5141 | rotatingtweets (WordPress plugin) | The Rotating Tweets (Twitter widget and shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's' 'rota | medium | 6.4 | 0% |