Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-3745 | wp-lightbox-2 (WordPress plugin) | The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, w | medium | 6.3 | 0% |
| CVE-2026-43878 | wwbn/avideo | Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal | medium | 6.1 | 0% |
| CVE-2024-3919 | openpgp-form-encryption (WordPress plugin) | The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputtin | medium | 4.6 | 0% |
| CVE-2025-2076 | binlayerpress (WordPress plugin) | The binlayerpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, | medium | 4.4 | 0% |
| CVE-2025-2078 | blogbuzztime-for-wp (WordPress plugin) | The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and incl | medium | 4.4 | 0% |
| CVE-2025-64027 | snipe/snipe-it | Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow | medium | 0.0 | 0% |
| CVE-2026-60092 | wwbn/avideo | AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel | medium | 0.0 | 0% |
| CVE-2024-1161 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes for blocks in | medium | 6.4 | 0% |
| CVE-2024-1164 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error messag | medium | 6.4 | 0% |
| CVE-2024-13542 | wp-google-street-view (WordPress plugin) | The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-13590 | ketchup-shortcodes (WordPress plugin) | The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-5221 | qi-blocks (WordPress plugin) | The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and in | medium | 6.4 | 0% |
| CVE-2025-47946 | symfony/ux-live-component, symfony/ux-twig-component | Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes | medium | 6.1 | 0% |
| CVE-2024-13848 | reaction-buttons (WordPress plugin) | The Reaction Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includi | medium | 5.5 | 0% |
| CVE-2026-24906 | october/system | October CMS has Stored XSS in Backend Editor Markup Classes | medium | 5.4 | 0% |
| CVE-2026-33051 | craftcms/cms | Craft CMS Vulnerable to Stored XSS in Revision Context Menu | medium | 0.0 | 0% |
| CVE-2026-34729 | phpmyfaq/phpmyfaq | phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() | medium | 6.1 | 0% |
| CVE-2025-5490 | football-pool (WordPress plugin) | The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, | medium | 5.5 | 0% |
| CVE-2026-84188 | librenms/librenms | LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users | medium | 4.8 | 0% |
| CVE-2024-4422 | comparison-slider (WordPress plugin) | The Comparison Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider title parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2025-32027 | yiisoft/yii | Yii does not prevent XSS in scenarios where fallback error renderer is used | medium | 6.1 | 0% |
| CVE-2026-105829 | league/commonmark | league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal | medium | 6.1 | 0% |
| CVE-2025-60796 | phppgadmin/phppgadmin | phppgadmin vulnerable to Cross-site Scripting | low | 0.0 | 0% |
| CVE-2026-26991 | librenms/librenms | LibreNMS /device-groups name Stored Cross-Site Scripting | medium | 0.0 | 0% |
| CVE-2026-26992 | librenms/librenms | LibreNMS /port-groups name Stored Cross-Site Scripting | medium | 0.0 | 0% |
| CVE-2026-33347 | league/commonmark | league/commonmark has an embed extension allowed_domains bypass | medium | 0.0 | 0% |
| CVE-2026-46367 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering | high | 7.6 | 0% |
| CVE-2025-6236 | hostel (WordPress plugin) | The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2026-104473 | yeswiki/yeswiki | YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities | medium | 0.0 | 0% |
| CVE-2024-13461 | autoship-cloud (WordPress plugin) | The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2025-6687 | magic-buttons-for-elementor (WordPress plugin) | The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in | medium | 6.4 | 0% |
| CVE-2025-6756 | ultimate-addons-for-contact-form-7 (WordPress plugin) | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS s | medium | 6.4 | 0% |
| CVE-2025-48203 | clickstorm/cs-seo | [clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability | medium | 5.5 | 0% |
| CVE-2026-29176 | craftcms/commerce | Craft Commerce has stored XSS in Inventory Location Name | medium | 0.0 | 0% |
| CVE-2025-0450 | betheme (WordPress plugin) | The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to | medium | 6.4 | 0% |
| CVE-2025-6068 | foogallery (WordPress plugin) | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Si | medium | 6.4 | 0% |
| CVE-2026-48167 | filament/infolists, filament/tables | Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS | medium | 6.4 | 0% |
| CVE-2025-5528 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon | medium | 6.1 | 0% |
| CVE-2026-39392 | ci4-cms-erp/ci4ms | CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization | medium | 5.5 | 0% |
| CVE-2025-5125 | custom-post-carousels-with-owl (WordPress plugin) | The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attri | medium | 4.8 | 0% |
| CVE-2024-0653 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and in | medium | 4.4 | 0% |
| CVE-2024-12045 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 4.4 | 0% |
| CVE-2025-62365 | librenms/librenms | LibreNMS is vulnerable to Reflected-XSS in `report_this` function | medium | 0.0 | 0% |
| CVE-2025-66309 | getgrav/grav | Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in | medium | 0.0 | 0% |
| CVE-2026-33517 | mantisbt/mantisbt | MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation | high | 0.0 | 0% |
| CVE-2024-11780 | site-search-360 (WordPress plugin) | The Site Search 360 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ss360-resultblock' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-12038 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | medium | 6.4 | 0% |
| CVE-2024-13455 | igumbi-online-booking (WordPress plugin) | The igumbi Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'igumbi_calendar' shortcode in | medium | 6.4 | 0% |
| CVE-2024-13456 | n-media-wp-simple-quiz (WordPress plugin) | The Easy Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wqt-question' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-13547 | athemes-addons-for-elementor-lite (WordPress plugin) | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver | medium | 6.4 | 0% |