Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5342 | simple-image-popup-shortcode (WordPress plugin) | The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sips_popup' shortcode i | medium | 6.4 | 0% |
| CVE-2024-5346 | flatsome (WordPress theme) | The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Si | medium | 6.4 | 0% |
| CVE-2024-5536 | gamipress-link (WordPress plugin) | The GamiPress – Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gamipress_link shortcode in all vers | medium | 6.4 | 0% |
| CVE-2024-5965 | mosaic (WordPress theme) | The Mosaic theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in | medium | 6.4 | 0% |
| CVE-2024-5966 | grey-opaque (WordPress theme) | The Grey Opaque theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Download-Button | medium | 6.4 | 0% |
| CVE-2024-6752 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster | medium | 6.4 | 0% |
| CVE-2024-9585 | image-map-pro (WordPress plugin) | The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'save_project' function with an arbitrary shortc | medium | 6.4 | 0% |
| CVE-2024-7775 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | medium | 5.5 | 0% |
| CVE-2024-3190 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 5.4 | 0% |
| CVE-2024-9872 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 5.4 | 0% |
| CVE-2025-1485 | wordpress-real-cookie-banner (WordPress plugin) | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 d | medium | 4.8 | 0% |
| CVE-2025-3584 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2025-4567 | post-slider-and-post-carousel (WordPress plugin) | The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of i | medium | 4.8 | 0% |
| CVE-2025-22644 | vayu-blocks (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Bloc | medium | 6.5 | 0% |
| CVE-2024-11420 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2025-5530 | woo-smart-compare (WordPress plugin) | The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' sho | medium | 6.4 | 0% |
| CVE-2024-13739 | newsletters-lite (WordPress plugin) | The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and inclu | medium | 6.1 | 0% |
| CVE-2025-1773 | traveler (WordPress theme) | The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and includin | medium | 6.1 | 0% |
| CVE-2025-5209 | ivory-search (WordPress plugin) | The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2021-3841 | sylius/sylius | Cross site scripting in sylius/sylius | medium | 4.1 | 0% |
| CVE-2025-27400 | openmage/magento-lts | Magento LTS vulnerable to stored XSS in theme config fields | low | 2.9 | 0% |
| CVE-2024-56364 | shuchkin/simplexlsx | Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx | medium | 6.8 | 0% |
| CVE-2025-4774 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Count | medium | 6.4 | 0% |
| CVE-2025-6787 | smart-docs (WordPress plugin) | The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartdocs_search' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2022-41615 | agile-store-locator (WordPress plugin) | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress. | medium | 6.1 | 0% |
| CVE-2026-75834 | getgrav/grav | Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate | medium | 5.4 | 0% |
| CVE-2024-4755 | google-cse (WordPress plugin) | The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-35738 | kognetiks-chatbot (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kognetiks Kognetiks Chatbot for | medium | 6.5 | 0% |
| CVE-2024-43335 | responsive-blocks (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks – | medium | 6.5 | 0% |
| CVE-2024-43935 | wp-delicious (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Delicious Delicious Recipes | medium | 6.5 | 0% |
| CVE-2024-51682 | ht-builder (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Builder – WordPress Theme | medium | 6.5 | 0% |
| CVE-2024-11132 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due t | medium | 6.4 | 0% |
| CVE-2025-0804 | clickwhale (WordPress plugin) | The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Store | medium | 6.4 | 0% |
| CVE-2025-1324 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'p | medium | 6.4 | 0% |
| CVE-2025-4479 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image compar | medium | 6.4 | 0% |
| CVE-2025-5143 | posts-table-filterable (WordPress plugin) | The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_po | medium | 6.4 | 0% |
| CVE-2025-5234 | gutenverse-news (WordPress plugin) | The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2025-5289 | interactive-3d-flipbook-powered-physics-engine (WordPress plugin) | The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 6.4 | 0% |
| CVE-2025-5338 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and | medium | 6.4 | 0% |
| CVE-2025-5940 | osomblocks (WordPress plugin) | The Osom Blocks – Custom Post Type listing block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ para | medium | 6.4 | 0% |
| CVE-2025-5950 | indieblocks (WordPress plugin) | The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2025-6537 | namasha-by-mdesign (WordPress plugin) | The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parameter in all versions | medium | 6.4 | 0% |
| CVE-2025-1626 | qi-blocks (WordPress plugin) | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a | medium | 5.4 | 0% |
| CVE-2025-1627 | qi-blocks (WordPress plugin) | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post | medium | 5.4 | 0% |
| CVE-2026-107380 | enshrined/svg-sanitize | enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision | medium | 5.4 | 0% |
| CVE-2025-5034 | wp-file-download (WordPress plugin) | The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading t | high | 7.1 | 0% |
| CVE-2025-8281 | wp-talroo (WordPress plugin) | The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | high | 7.1 | 0% |
| CVE-2025-0469 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2025-5488 | wp-masonry-infinite-scroll (WordPress plugin) | The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all | medium | 6.4 | 0% |
| CVE-2025-6350 | wpvr (WordPress plugin) | The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | medium | 6.4 | 0% |