Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-42877 | facturascripts/facturascripts | FacturaScripts vulnerable to stored XSS via product reference in sales/purchases | medium | 5.4 | 0% |
| CVE-2026-5362 | pimcore/pimcore | Pimcore has an authenticated Cross-site Scripting issue | medium | 0.0 | 0% |
| CVE-2024-11937 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Me | medium | 6.4 | 0% |
| CVE-2025-3075 | elementor (WordPress plugin) | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2026-31859 | craftcms/cms | CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization | medium | 0.0 | 0% |
| CVE-2026-47760 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs | high | 8.7 | 0% |
| CVE-2026-43876 | wwbn/avideo | AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers | medium | 6.4 | 0% |
| CVE-2026-6745 | bagisto/bagisto | Bagisto affected by Cross-site Scripting | low | 3.5 | 0% |
| CVE-2025-23081 | mediawiki/data-transfer | Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) | medium | 0.0 | 0% |
| CVE-2026-31822 | sylius/sylius | Sylius has a XSS vulnerability in checkout login form | medium | 0.0 | 0% |
| CVE-2025-67648 | shopware/shopware, shopware/storefront | Shopware Storefront Reflected XSS in Storefront Login Page | high | 7.1 | 0% |
| CVE-2026-31351 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module | medium | 4.8 | 0% |
| CVE-2024-7816 | gixaw-chat (WordPress plugin) | The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 6.1 | 0% |
| CVE-2024-7818 | misiek-photo-album (WordPress plugin) | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escapi | medium | 6.1 | 0% |
| CVE-2024-7822 | quick-code (WordPress plugin) | The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 6.1 | 0% |
| CVE-2024-7860 | simple-headline-rotator (WordPress plugin) | The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as esc | medium | 6.1 | 0% |
| CVE-2024-7861 | misiek-paypal (WordPress plugin) | The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 6.1 | 0% |
| CVE-2026-46360 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS | medium | 5.4 | 0% |
| CVE-2026-46363 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization | medium | 5.4 | 0% |
| CVE-2025-65621 | snipe/snipe-it | Snipe-IT is vulnerable to stored cross-site scripting | medium | 5.4 | 0% |
| CVE-2025-12761 | drupal/simple_multistep | This module provides the ability to convert any entity form into a simple multi-step form. The module doesn’t sufficien | low | 3.5 | 0% |
| CVE-2025-2163 | zoorum-comments (WordPress plugin) | The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due | medium | 6.1 | 0% |
| CVE-2026-34974 | thorsten/phpmyfaq | phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation | medium | 5.4 | 0% |
| CVE-2026-42842 | getgrav/grav | Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel | medium | 5.4 | 0% |
| CVE-2024-6859 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2024-7687 | azindex (WordPress plugin) | The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | medium | 4.3 | 0% |
| CVE-2026-8197 | concrete5/concrete5 | Concrete CMS is vulnerable to Stored XSS via OAuth integration name | high | 0.0 | 0% |
| CVE-2026-41661 | admidio/admidio | Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion | medium | 6.1 | 0% |
| CVE-2026-56381 | craftcms/cms | Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page | low | 0.0 | 0% |
| CVE-2026-33683 | wwbn/avideo | AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field | medium | 5.4 | 0% |
| CVE-2024-6712 | mapfig-studio (WordPress plugin) | The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, w | medium | 6.1 | 0% |
| CVE-2025-1382 | contact-us (WordPress plugin) | The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as es | medium | 6.1 | 0% |
| CVE-2025-65961 | contao/core-bundle | Contao is vulnerable to cross-site scripting in templates | low | 3.3 | 0% |
| CVE-2026-117537 | redaxo/source | REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required) | low | 0.0 | 0% |
| CVE-2026-117538 | redaxo/source | REDAXO has reflected XSS backend packages API via function parameter (CSRF token required) | low | 0.0 | 0% |
| CVE-2024-11141 | sailthru-triggermail (WordPress plugin) | The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which | medium | 6.1 | 0% |
| CVE-2026-31350 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Page Sign parameter | medium | 5.4 | 0% |
| CVE-2026-31353 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Category module | medium | 5.4 | 0% |
| CVE-2026-30913 | flarum/nicknames | flarum/nicknames extension has display name injection in notification emails (autolink & markdown) | medium | 4.6 | 0% |
| CVE-2025-8427 | beaver-builder (WordPress plugin) | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter | medium | 6.4 | 0% |
| CVE-2026-45138 | ci4-cms-erp/ci4ms | CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule | medium | 5.4 | 0% |
| CVE-2026-116891 | mediawiki/semantic-media-wiki | Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354) | medium | 6.1 | 0% |
| CVE-2026-41061 | wwbn/avideo | WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver | medium | 5.4 | 0% |
| CVE-2026-9811 | mautic/core | Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector | medium | 5.4 | 0% |
| CVE-2025-0687 | spiritual-gifts-survey-\(and-optional-s.h.a.p.e-survey\) (WordPress plugin) | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before o | medium | 6.1 | 0% |
| CVE-2025-0688 | spiritual-gifts-survey-\(and-optional-s.h.a.p.e-survey\) (WordPress plugin) | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before o | medium | 6.1 | 0% |
| CVE-2026-55746 | cotonti/cotonti | Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module | high | 7.6 | 0% |
| CVE-2026-22210 | wpdiscuz (WordPress plugin) | wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attach | medium | 4.4 | 0% |
| CVE-2024-8095 | babeiz (WordPress plugin) | The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | medium | 6.1 | 0% |
| CVE-2026-48157 | slim/slim | Slim has Reflected XSS in the HtmlErrorRenderer | medium | 6.1 | 0% |