Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-1459 | siteorigin-panels (WordPress plugin) | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(PB) widget in all ve | medium | 6.4 | 0% |
| CVE-2022-38075 | mantenimiento-web (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPres | medium | 6.1 | 0% |
| CVE-2025-5194 | wp-map-block (WordPress plugin) | The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page | medium | 4.8 | 0% |
| CVE-2026-42612 | getgrav/grav | Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes | high | 8.5 | 0% |
| CVE-2026-3241 | concrete5/concrete5 | Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2025-64174 | openmage/magento-lts | OpenMage vulnerable to XSS in Admin Notifications | medium | 0.0 | 0% |
| CVE-2024-11405 | wp-front-end-login-and-register (WordPress plugin) | The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_passwo | medium | 6.1 | 0% |
| CVE-2025-31682 | drupal/google_tag | This module enables you to integrate the site with the Google Tag Manager (GTM) application. The module doesn't have th | medium | 4.8 | 0% |
| CVE-2026-39390 | ci4-cms-erp/ci4ms | CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting | medium | 5.5 | 0% |
| CVE-2026-45694 | librenms/librenms | LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment | medium | 5.4 | 0% |
| CVE-2024-2113 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-12820 | google-distance-calculator (WordPress plugin) | The MK Google Directions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MKGD' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2025-0839 | zoomsounds (WordPress plugin) | The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due t | medium | 6.4 | 0% |
| CVE-2025-5035 | firelight-lightbox (WordPress plugin) | The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, whic | medium | 5.4 | 0% |
| CVE-2025-5093 | responsive-lightbox (WordPress plugin) | The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes | medium | 5.4 | 0% |
| CVE-2025-2799 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | medium | 4.4 | 0% |
| CVE-2025-32427 | verbb/formie | Formie has XSS vulnerability for importing forms | medium | 0.0 | 0% |
| CVE-2026-34561 | ci4-cms-erp/ci4ms | CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via S | critical | 9.1 | 0% |
| CVE-2024-9416 | modula-best-grid-gallery (WordPress plugin) | The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript libr | medium | 6.4 | 0% |
| CVE-2025-10006 | page-builder (WordPress plugin) | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rev_slider_vc' shortcode in al | medium | 6.4 | 0% |
| CVE-2025-1663 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions u | medium | 6.4 | 0% |
| CVE-2025-5539 | wp-easy-contact (WordPress plugin) | The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu | medium | 6.4 | 0% |
| CVE-2025-2808 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Num | medium | 5.4 | 0% |
| CVE-2026-61825 | code16/sharp | code16/sharp has a stored XSS via data-html-content Sanitizer Bypass | high | 8.7 | 0% |
| CVE-2026-3242 | concrete5/concrete5 | Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2025-32426 | verbb/formie | Formie has XSS vulnerability for email notification content for preview | medium | 4.6 | 0% |
| CVE-2025-7502 | page-builder (WordPress plugin) | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all vers | medium | 6.4 | 0% |
| CVE-2026-32757 | admidio/admidio | Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection | medium | 5.4 | 0% |
| CVE-2024-12043 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin for WordPress is vuln | medium | 6.4 | 0% |
| CVE-2024-12477 | avada-builder (WordPress plugin) | The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2024-12504 | videowhisper-live-streaming-integration (WordPress plugin) | The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2024-13354 | responsive-addons-for-elementor (WordPress plugin) | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cros | medium | 6.4 | 0% |
| CVE-2024-13389 | cliptakes (WordPress plugin) | The Cliptakes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cliptakes_input_email' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2024-13458 | notice-faq (WordPress plugin) | The WordPress SEO Friendly Accordion FAQ with AI assisted content generation plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-13572 | precious-metals-chart-and-widgets (WordPress plugin) | The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfu | medium | 6.4 | 0% |
| CVE-2024-13586 | masy-gallery (WordPress plugin) | The Masy Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'justified-gallery' shortcode in all ver | medium | 6.4 | 0% |
| CVE-2026-39960 | mantisbt/mantisbt | MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values | medium | 5.4 | 0% |
| CVE-2026-39391 | ci4-cms-erp/ci4ms | CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List | medium | 4.8 | 0% |
| CVE-2025-28094 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) | medium | 6.5 | 0% |
| CVE-2024-3063 | wpb-elementor-addons (WordPress plugin) | The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the output of 'tags' added to widgets in all | medium | 6.4 | 0% |
| CVE-2025-3276 | skt-blocks (WordPress plugin) | The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block | medium | 6.4 | 0% |
| CVE-2025-66308 | getgrav/grav | Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]` | medium | 0.0 | 0% |
| CVE-2025-66310 | getgrav/grav | Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab | medium | 0.0 | 0% |
| CVE-2025-66311 | getgrav/grav | Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters | medium | 0.0 | 0% |
| CVE-2025-66312 | getgrav/grav | Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName] | medium | 0.0 | 0% |
| CVE-2024-13748 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions u | medium | 4.4 | 0% |
| CVE-2026-3244 | concrete5/concrete5 | Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 0% |
| CVE-2026-34396 | wwbn/avideo | AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel | medium | 6.1 | 0% |
| CVE-2026-33500 | wwbn/avideo | AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization | medium | 5.4 | 0% |
| CVE-2026-40296 | phpoffice/phpspreadsheet | PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer | medium | 5.4 | 0% |