Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-9809 | mautic/core | Mautic has Stored Cross-Site Scripting (XSS) in Projects Component | high | 7.6 | 0% |
| CVE-2023-31218 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Edito | high | 7.1 | 0% |
| CVE-2024-9993 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2024-9994 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2024-8054 | mm-breaking-news (WordPress plugin) | The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping | medium | 6.1 | 0% |
| CVE-2026-61807 | snipe/snipe-it | Snipe-IT: Stored DOM XSS via table selected-count IDs | medium | 0.0 | 0% |
| CVE-2026-5370 | krayin/laravel-crm | Krayin CRM is vulnerable to Cross-site Scripting (XSS) | low | 3.5 | 0% |
| CVE-2026-61823 | code16/sharp | code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute | high | 7.3 | 0% |
| CVE-2026-36341 | krayin/laravel-crm | Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint | medium | 5.4 | 0% |
| CVE-2024-47058 | mautic/core, mautic/core-lib | Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field) | medium | 4.8 | 0% |
| CVE-2025-14448 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Se | medium | 5.4 | 0% |
| CVE-2024-6224 | send-email-only-on-reply-to-my-comment (WordPress plugin) | The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisati | medium | 5.9 | 0% |
| CVE-2026-40479 | kimai/kimai | Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget | medium | 5.4 | 0% |
| CVE-2025-5275 | charitable (WordPress plugin) | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cr | medium | 4.4 | 0% |
| CVE-2025-5921 | sureforms (WordPress plugin) | The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 5.8 | 0% |
| CVE-2025-5567 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM elem | medium | 6.4 | 0% |
| CVE-2025-6383 | wp-photonav (WordPress plugin) | The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2025-65622 | snipe/snipe-it | Snipe-IT allows stored XSS via the Locations "Country" field | medium | 0.0 | 0% |
| CVE-2025-10926 | drupal/json_field | This module enables you to store and display JSON data using optional 3rd party libraries. The module doesn't sufficien | medium | 6.1 | 0% |
| CVE-2025-12083 | drupal/civictheme | CivicTheme is a design system and theme framework used to build content-rich Drupal websites. It includes editorial work | medium | 6.1 | 0% |
| CVE-2025-8280 | contact-form-7-recaptcha (WordPress plugin) | The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back | medium | 5.8 | 0% |
| CVE-2026-35453 | phpoffice/phpspreadsheet | PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer | medium | 0.0 | 0% |
| CVE-2026-6367 | drupal/core | Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5. The suggestions ar | medium | 6.1 | 0% |
| CVE-2025-10931 | drupal/umami_analytics | This module enables you to add Umami Analytics web statistics tracking system to your website. The "administer umami an | low | 3.8 | 0% |
| CVE-2026-32278 | opensource-workshop/connect-cms | Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin | high | 8.2 | 0% |
| CVE-2026-56347 | wwbn/avideo | AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin | medium | 6.1 | 0% |
| CVE-2024-0756 | insert-or-embed-articulate-content (WordPress plugin) | The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing att | medium | 5.4 | 0% |
| CVE-2026-33548 | mantisbt/mantisbt | MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline | medium | 6.1 | 0% |
| CVE-2025-5537 | foobox-image-lightbox (WordPress plugin) | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative | medium | 6.4 | 0% |
| CVE-2025-6244 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2025-6743 | woodmart (WordPress plugin) | The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions | medium | 6.4 | 0% |
| CVE-2025-5570 | ai-engine (WordPress plugin) | The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all version | medium | 5.4 | 0% |
| CVE-2026-24907 | october/system | October CMS has Stored XSS in Event Log Mail Preview | medium | 5.4 | 0% |
| CVE-2024-52305 | unopim/unopim | UnoPim Stored XSS : Cookie hijacking through Create User function | high | 7.3 | 0% |
| CVE-2025-3076 | elementor-page-builder (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all v | medium | 6.4 | 0% |
| CVE-2025-4965 | page-builder (WordPress plugin) | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feat | medium | 6.4 | 0% |
| CVE-2025-5559 | timezonecalculator (WordPress plugin) | The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortc | medium | 6.4 | 0% |
| CVE-2025-5585 | siteorigin-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in | medium | 6.4 | 0% |
| CVE-2025-6290 | tournament-bracket-generator (WordPress plugin) | The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in a | medium | 6.4 | 0% |
| CVE-2025-6538 | post-rating-and-review (WordPress plugin) | The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2025-6546 | drive-folder-embeder (WordPress plugin) | The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all version | medium | 6.4 | 0% |
| CVE-2025-6689 | fl3r-accessibility-suite (WordPress plugin) | The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite short | medium | 6.4 | 0% |
| CVE-2026-63001 | redaxo/source | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` | medium | 4.8 | 0% |
| CVE-2026-63002 | redaxo/source | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames | medium | 4.8 | 0% |
| CVE-2026-50183 | wwbn/avideo | WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section | medium | 4.7 | 0% |
| CVE-2025-65012 | getkirby/cms | Kirby CMS has cross-site scripting (XSS) in the changes dialog | medium | 0.0 | 0% |
| CVE-2026-61453 | getgrav/grav | Grav: XSS Blueprint Validation Bypass via Twig String Concatenation | medium | 0.0 | 0% |
| CVE-2026-39367 | wwbn/avideo | WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page | medium | 5.4 | 0% |
| CVE-2025-3153 | concrete5/concrete5 | Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) | medium | 0.0 | 0% |
| CVE-2025-10927 | drupal/plausible_tracking | This module integrates Plausible Analytics on a site. The module did not properly filter output in certain cases. This | medium | 6.1 | 0% |