Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-66843 | getgrav/grav | Grav is vulnerable to Stored XSS through authenticated user-edited content | medium | 5.4 | 0% |
| CVE-2026-47694 | wwbn/avideo | WWBN AVideo: Stored XSS via unescaped Gallery category description | medium | 5.4 | 0% |
| CVE-2026-33883 | statamic/cms | Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag | medium | 6.1 | 0% |
| CVE-2026-31823 | sylius/sylius | Sylius Vulnerable to Authenticated Stored XSS | medium | 4.8 | 0% |
| CVE-2026-8139 | concrete5/concrete5 | Concrete CMS is vulnerable to Stored XSS via external-link page cvName | low | 0.0 | 0% |
| CVE-2026-8353 | concrete5/concrete5 | Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme | low | 0.0 | 0% |
| CVE-2026-27937 | october/system | October CMS: Reflected XSS via DataTable Form Widget | low | 3.1 | 0% |
| CVE-2026-23695 | cockpit-hq/cockpit | Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option | medium | 5.4 | 0% |
| CVE-2026-31313 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module | medium | 5.4 | 0% |
| CVE-2026-45580 | wwbn/avideo | AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | medium | 5.4 | 0% |
| CVE-2025-64711 | privatebin/privatebin | PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users | low | 3.9 | 0% |
| CVE-2026-8203 | concrete5/concrete5 | Concrete CMS has Stored XSS through its height parameter | high | 0.0 | 0% |
| CVE-2016-20054 | khodakhah/nodcms | Nodcms contains a cross-site request forgery vulnerability | medium | 4.3 | 0% |
| CVE-2026-27964 | facturascripts/facturascripts | FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation | low | 3.9 | 0% |
| GHSA-9v82-vcjx-m76j | shopware/core, shopware/shopware | Shopware: Reflective Cross Site-Scripting (XSS) in CMS components | high | 8.8 | – |
| GHSA-x428-565f-8xj2 | typo3/cms-core | TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API | high | 8.8 | – |
| CVE-2026-49259 | nukeviet/nukeviet | NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | high | 8.7 | – |
| CVE-2026-54064 | nukeviet/nukeviet | NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module | high | 8.7 | – |
| CVE-2026-48118 | nukeviet/nukeviet | NukeViet: Unauthenticated Reflected XSS in Comment Module | high | 8.2 | – |
| GHSA-9j5w-2cqc-cwj9 | openmage/magento-lts | Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor | high | 7.5 | – |
| GHSA-95m2-chm4-mq7m | netcarver/textile | PHP-Textile has persistent XSS vulnerability in image link handling | high | 7.3 | – |
| GHSA-2f46-4xjm-73x5 | passbolt/passbolt_api | Passbolt API Stored XSS on first/last name during setup | high | 7.2 | – |
| GHSA-6mp4-q625-mxjp | yourls/yourls | YOURLS is vulnerable to XSS through JSONP and Callback request parameters | high | 7.1 | – |
| GHSA-gxxh-8vcj-w2mh | mckenziearts/livewire-markdown-editor | livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler | high | 7.1 | – |
| GHSA-rv3r-vqjj-8c76 | getkirby/cms | Cross-site scripting from content entered in the tags and multiselect fields | high | 7.1 | – |
| GHSA-6f85-3f8q-qc94 | oro/commerce | OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor | medium | 6.9 | – |
| GHSA-5gr6-97fv-52cc | typo3/cms | Cross-Site Scripting in TYPO3 CMS | medium | 6.5 | – |
| CVE-2025-30081 | clickstorm/cs-seo | Clickstorm SEO Allows Cross-Site Scripting (XSS) | medium | 6.3 | – |
| GHSA-22q7-cg4r-p9mx | typo3/cms-fluid | TYPO3 Cross-Site Scripting in Fluid ViewHelpers | medium | 6.1 | – |
| GHSA-34q6-xqxh-gq39 | silverstripe/framework | Silverstripe XSS In rewritten hash links | medium | 6.1 | – |
| GHSA-4459-qrcc-vfcf | typo3/cms-core | TYPO3 Cross-Site Scripting in Form Framework | medium | 6.1 | – |
| GHSA-468j-6jrc-2rjx | silverstripe/framework | silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField` | medium | 6.1 | – |
| GHSA-4h54-vwx9-3vr3 | silverstripe/framework | Silverstripe XSS In FormAction | medium | 6.1 | – |
| GHSA-4h5c-5g25-v7fh | typo3/cms | TYPO3 Cross-Site Scripting in Form Framework | medium | 6.1 | – |
| GHSA-4ppr-jw47-9qm5 | typo3/cms-core | TYPO3 Cross-Site Scripting in Link Handling | medium | 6.1 | – |
| GHSA-4v57-pwvf-x35j | zendframework/zendframework1 | Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` | medium | 6.1 | – |
| GHSA-4vf6-mq7w-3hp6 | zendframework/zendframework1 | Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed | medium | 6.1 | – |
| GHSA-5f5v-5c3v-gw5v | silverstripe/framework | Silverstripe IE requests not properly behaving with rewritehashlinks | medium | 6.1 | – |
| GHSA-5gmf-3c43-q73v | zendframework/zendframework | ZendFramework vulnerable to Cross-site Scripting | medium | 6.1 | – |
| GHSA-6hh6-59j2-qrxw | silverstripe/cms | Silverstripe History XSS Vulnerability | medium | 6.1 | – |
| GHSA-6xwf-7rfm-4gwc | typo3/cms-core | TYPO3 Cross-Site Scripting in Filelist Module | medium | 6.1 | – |
| GHSA-76r3-m635-p3vc | typo3/cms-core | TYPO3 Cross-Site Scripting in Language Pack Handling | medium | 6.1 | – |
| GHSA-85ch-44w7-rf32 | typo3/cms | TYPO3 Cross-Site Scripting in Fluid ViewHelpers | medium | 6.1 | – |
| GHSA-88jp-9jrv-6368 | silverstripe/framework | Silverstripe XSS In GridField print | medium | 6.1 | – |
| GHSA-8c25-vj2w-p72j | typo3/cms-core | TYPO3 Cross-Site Scripting in Frontend User Login | medium | 6.1 | – |
| GHSA-8q77-cv62-jj38 | zendframework/zendframework | Zendframework has potential Cross-site Scripting vector in multiple view helpers | medium | 6.1 | – |
| GHSA-95qm-3xp7-vfj5 | typo3/cms-core | TYPO3 Cross-Site Scripting in Form Framework validation handling | medium | 6.1 | – |
| GHSA-97jm-g33h-f46g | silverstripe/framework | silverstripe/framework ReadOnly transformation for formfields exploitable | medium | 6.1 | – |
| GHSA-g4c9-qfvw-fmr4 | typo3/cms-core | TYPO3 Cross-Site Scripting in Backend Modal Component | medium | 6.1 | – |
| GHSA-g52p-86j5-xr8q | zendframework/zendframework1 | ZendFramework Potential Cross-site Scripting in Development Environment Error View Script | medium | 6.1 | – |