Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13549 | all-bootstrap-blocks (WordPress plugin) | The All Bootstrap Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Accordion" widget in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-13573 | zigaform (WordPress plugin) | The Zigaform – Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_rfvar' shortcode i | medium | 6.4 | 0% |
| CVE-2024-13577 | cats-job-listings (WordPress plugin) | The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-13578 | wp-bibtex (WordPress plugin) | The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-13579 | wp-asambleas (WordPress plugin) | The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'polls_popup' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-13581 | simple-charts (WordPress plugin) | The Simple Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simple_chart' shortcode in all version | medium | 6.4 | 0% |
| CVE-2024-13582 | simple-pricing-tables-vc-extension (WordPress plugin) | The Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Script | medium | 6.4 | 0% |
| CVE-2024-13587 | zigaform-calculator-cost-estimation-form-builder-lite (WordPress plugin) | The Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | medium | 6.4 | 0% |
| CVE-2024-13588 | simplebooklet (WordPress plugin) | The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' | medium | 6.4 | 0% |
| CVE-2024-13644 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's De Gallery widget in all ver | medium | 6.4 | 0% |
| CVE-2024-13701 | stklcode-liveticker (WordPress plugin) | The Liveticker (by stklcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in al | medium | 6.4 | 0% |
| CVE-2024-13751 | 3d-photo-gallery (WordPress plugin) | The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des[]' parameter in all versions up to, and | medium | 6.4 | 0% |
| CVE-2025-4584 | irm-newsroom (WordPress plugin) | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2025-4585 | irm-newsroom (WordPress plugin) | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmflat' shortcode in all versions up t | medium | 6.4 | 0% |
| CVE-2025-4586 | irm-newsroom (WordPress plugin) | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2025-5123 | contact-us-page-contact-people (WordPress plugin) | The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all vers | medium | 6.4 | 0% |
| CVE-2025-5398 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use | medium | 6.4 | 0% |
| CVE-2025-5540 | wp-easy-events (WordPress plugin) | The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb | medium | 6.4 | 0% |
| CVE-2025-5929 | the-countdown (WordPress plugin) | The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and | medium | 6.4 | 0% |
| CVE-2025-6462 | elisqlreports (WordPress plugin) | The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPO | medium | 6.4 | 0% |
| CVE-2024-13851 | modal-portfolio (WordPress plugin) | The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to i | medium | 5.5 | 0% |
| CVE-2024-13667 | uncode (WordPress theme) | The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and i | medium | 5.4 | 0% |
| CVE-2024-13517 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 4.4 | 0% |
| CVE-2024-4419 | fetch-jft (WordPress plugin) | The Fetch JFT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8 | medium | 4.4 | 0% |
| CVE-2026-27126 | craftcms/cms | Craft CMS has Stored XSS in Table Field via "HTML" Column Type | medium | 0.0 | 0% |
| CVE-2025-7498 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all version | medium | 6.4 | 0% |
| CVE-2025-6200 | geodirectory (WordPress plugin) | The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.9 | 0% |
| CVE-2026-30838 | league/commonmark | CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names | medium | 0.0 | 0% |
| CVE-2026-56736 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission | high | 8.2 | 0% |
| CVE-2024-11832 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JavaScript row | medium | 6.4 | 0% |
| CVE-2024-12304 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via but | medium | 6.4 | 0% |
| CVE-2024-9058 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2025-7205 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes | medium | 5.4 | 0% |
| CVE-2025-5730 | contact-form (WordPress plugin) | The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.3 | 0% |
| CVE-2025-48206 | nitsan/ns-backup | The Backup Plus extension for TYPO3 (ns_backup) allows XSS | low | 0.0 | 0% |
| CVE-2026-30879 | baserproject/basercms | baserCMS has a cross-site scripting vulnerability in blog posts | medium | 0.0 | 0% |
| CVE-2026-3240 | concrete5/concrete5 | Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 0% |
| CVE-2026-63498 | snipe/snipe-it | Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API | high | 8.7 | 0% |
| CVE-2024-13350 | searchiq (WordPress plugin) | The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortc | medium | 6.4 | 0% |
| CVE-2024-13388 | tcbd-tooltip (WordPress plugin) | The TCBD Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbdtooltip_text' shortcode in all vers | medium | 6.4 | 0% |
| CVE-2025-1407 | amo-team-showcase (WordPress plugin) | The AMO Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's amoteam_skills shortcode in all ver | medium | 6.4 | 0% |
| CVE-2026-2897 | funadmin/funadmin | funadmin: XSS through Value argument in Backend Interface component | low | 2.4 | 0% |
| CVE-2025-6686 | magic-buttons-for-elementor (WordPress plugin) | The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in | medium | 6.4 | 0% |
| CVE-2025-6997 | addons (WordPress plugin) | The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2025-65186 | getgrav/grav | Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor | medium | 6.1 | 0% |
| CVE-2026-33499 | wwbn/avideo | AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php | medium | 6.1 | 0% |
| CVE-2025-3130 | drupal/obfuscate | This module enables you to obfuscate email addresses, to avoid them being easily available to spammers. The module does | medium | 5.4 | 0% |
| CVE-2026-32612 | statamic/cms | Statamic vulnerable to privilege escalation via stored cross-site scripting | medium | 5.4 | 0% |
| CVE-2026-33628 | invoiceninja/invoiceninja | Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items | medium | 5.4 | 0% |
| CVE-2024-13402 | buddyboss-platform (WordPress plugin) | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up t | medium | 6.4 | 0% |