Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-2728 | librenms/librenms | LibreNMS: Cross-Site Scripting in ShowConfigController | low | 3.5 | 0% |
| CVE-2025-29790 | contao/core-bundle | Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads | medium | 0.0 | 0% |
| CVE-2026-56393 | craftcms/cms | Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options | low | 0.0 | 0% |
| CVE-2025-2299 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. | medium | 6.1 | 0% |
| CVE-2026-34739 | wwbn/avideo | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | medium | 6.1 | 0% |
| CVE-2026-27621 | typicms/core | TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload | medium | 0.0 | 0% |
| CVE-2026-29177 | craftcms/commerce | Craft Commerce has stored XSS in Craft Commerce Order Details Slideout | low | 0.0 | 0% |
| CVE-2025-54676 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Cale | medium | 6.5 | 0% |
| CVE-2025-1622 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2026-52838 | alextselegidis/easyappointments | Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS | low | 2.6 | 0% |
| CVE-2025-71177 | lavalite/cms | LavaLite CMS affected by a stored cross-site scripting vulnerability | medium | 0.0 | 0% |
| CVE-2025-1458 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2025-3468 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | medium | 6.4 | 0% |
| CVE-2025-8046 | injection-guard (WordPress plugin) | The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attr | medium | 6.1 | 0% |
| CVE-2025-8113 | ebook-store (WordPress plugin) | The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribu | medium | 6.1 | 0% |
| CVE-2025-11570 | drupal-pattern-lab/unified-twig-extensions | drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS | low | 0.0 | 0% |
| CVE-2026-34598 | yeswiki/yeswiki | YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter" | high | 0.0 | 0% |
| CVE-2024-13400 | kona-instagram-feed-for-gutenberg (WordPress plugin) | The Kona Gallery Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Kona: Instagram for Gutenberg" Block, spec | medium | 6.4 | 0% |
| CVE-2024-13460 | we-testimonial-slider (WordPress plugin) | The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions u | medium | 6.4 | 0% |
| CVE-2024-13527 | philantro (WordPress plugin) | The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes | medium | 6.4 | 0% |
| CVE-2024-13642 | stratum (WordPress plugin) | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hotspot widget in a | medium | 6.4 | 0% |
| CVE-2024-13664 | wp-post-list-table (WordPress plugin) | The WP Post List Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpb_post_list_table' shortcode in | medium | 6.4 | 0% |
| CVE-2024-13670 | music-sheet-viewer (WordPress plugin) | The Music Sheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pn_msv' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-13675 | slingblocks (WordPress plugin) | The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-13700 | embed-swagger-ui (WordPress plugin) | The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2025-1261 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Cou | medium | 6.4 | 0% |
| CVE-2025-1664 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2025-8897 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' param | medium | 6.1 | 0% |
| CVE-2026-50182 | wwbn/avideo | WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination | medium | 6.1 | 0% |
| CVE-2025-57407 | gp247/core, s-cart/core | GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability | low | 0.0 | 0% |
| CVE-2023-6529 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users | medium | 6.1 | 0% |
| CVE-2026-6365 | drupal/core | Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can l | medium | 6.1 | 0% |
| CVE-2026-31352 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Role Management module | medium | 5.4 | 0% |
| CVE-2026-31354 | feehi/cms | Feehi CMS has authenticated stored cross-site scripting (XSS) vulnerabilities via the Permissions module | medium | 5.4 | 0% |
| CVE-2026-33295 | wwbn/avideo | AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php | high | 0.0 | 0% |
| CVE-2025-65956 | getformwork/formwork | Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags | medium | 6.5 | 0% |
| CVE-2021-24559 | qyrr (WordPress plugin) | The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-S | medium | 5.4 | 0% |
| CVE-2026-44831 | snipe/snipe-it | Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) | medium | 4.8 | 0% |
| CVE-2026-56383 | craftcms/cms | Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type | low | 0.0 | 0% |
| CVE-2024-11916 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due t | high | 7.4 | 0% |
| CVE-2025-6378 | responsive-food-and-drink-menu (WordPress plugin) | The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shor | medium | 6.4 | 0% |
| CVE-2026-25133 | october/rain | October Rain has Stored XSS via SVG Filter Bypass | medium | 4.8 | 0% |
| CVE-2025-62798 | code16/sharp | Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax | medium | 5.4 | 0% |
| CVE-2026-41063 | wwbn/avideo | WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS | medium | 5.4 | 0% |
| CVE-2026-29175 | craftcms/commerce | Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking | high | 0.0 | 0% |
| CVE-2024-13469 | pricingtable (WordPress plugin) | The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to | medium | 6.4 | 0% |
| CVE-2024-13702 | crm-customer-relationship-management-by-vcita (WordPress plugin) | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingSchedul | medium | 6.4 | 0% |
| CVE-2024-9019 | secupress (WordPress plugin) | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupress_check_b | medium | 6.4 | 0% |
| CVE-2025-1439 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2026-12202 | intelliants/subrion | Subrion CMS vulnerable to Cross-site Scripting | low | 2.4 | 0% |