Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-5cwr-5jxg-pcf6 | winter/wn-backend-module | Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles | medium | 4.5 | – |
| GHSA-hq84-x37p-j6q5 | winter/wn-backend-module | Winter: Reflected XSS through the search query parameter in the backend Table widget | medium | 4.5 | – |
| GHSA-frm9-7pm9-5rgc | silverstripe/comments | SilverStripe comments module includes version of jQuery vulnerable to Cross-site Scripting | medium | 4.4 | – |
| GHSA-v86m-j5f7-ccwh | passbolt/passbolt_api | Passbolt Api E-mail HTML injection | medium | 4.4 | – |
| GHSA-vr95-p7q6-8m9q | laravel/framework | Laravel Cross-site Scripting (XSS) vulnerability in blade templating | medium | 4.3 | – |
| GHSA-779c-7w4p-2c4g | silverstripe/admin | Silverstripe admin XSS Vulnerability via WYSIWYG editor | low | 3.8 | – |
| CVE-2025-2967 | concrete5/concrete5 | ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field | low | 3.5 | – |
| CVE-2026-44701 | devcode-it/openstamanager | OpenSTAManager has HTML Injection in modules/utenti/edit.php | low | 3.5 | – |
| CVE-2026-45710 | facturascripts/facturascripts | FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes i | low | 3.5 | – |
| GHSA-7mpf-4465-7fc2 | winter/wn-backend-module | Winter: Stored XSS through Backend List widget image columns | low | 2.0 | – |
| CVE-2021-3142 | mautic/core | XSS in Mautic | high | 0.0 | – |
| CVE-2024-43372 | ezsystems/ezplatform-richtext | Persistent Cross-site Scripting in eZ Platform Rich Text Field Type | high | 0.0 | – |
| CVE-2026-52847 | mantisbt/mantisbt | MantisBT: Reflected XSS in admin/install.php | critical | 0.0 | – |
| CVE-2026-52881 | mantisbt/mantisbt | MantisBT: Reflected XSS in admin/install.php via unescaped printf | critical | 0.0 | – |
| CVE-2026-62944 | mantisbt/mantisbt | MantisBT: Stored XSS in print_all_bug_page_word.php | high | 0.0 | – |
| CVE-2026-96632 | adminneo-org/adminneo | AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) | high | 0.0 | – |
| GHSA-259v-xm34-p7fr | typo3/cms | Typo3 Cross-Site Scripting in Language Pack Handling | medium | 0.0 | – |
| GHSA-28fw-88hq-6jmm | shopware/shopware | Persistent XSS in shopping worlds | low | 0.0 | – |
| GHSA-2fch-hv74-fgw9 | wwbn/avideo | Cross site scripting (XSS) in wwbn/avideo | high | 0.0 | – |
| GHSA-2mx6-fq24-g2mh | ibexa/admin-ui | ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal | medium | 0.0 | – |
| GHSA-2vh3-cj9j-mcj5 | ezsystems/ezpublish-legacy | eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template | medium | 0.0 | – |
| GHSA-3h6j-9x8m-rg3g | j0k3r/graby | Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config | low | 0.0 | – |
| GHSA-44jg-mv3h-wj6g | solspace/craft-freeform | solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data | low | 0.0 | – |
| GHSA-4c2w-v5rq-5mx7 | ezsystems/ezplatform-admin-ui-assets | eZ Platform Editor Cross-site Scripting (XSS) | medium | 0.0 | – |
| GHSA-52xf-h226-pfgx | leantime/leantime | Leantime allows Refelected Cross-Site Scripting (XSS) | medium | 0.0 | – |
| GHSA-5822-pw57-vv37 | pterodactyl/panel | XSS vulnerability when listing users on add & modify server pages. | medium | 0.0 | – |
| GHSA-58h5-h554-429q | ezsystems/ezplatform-admin-ui | ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS) | critical | 0.0 | – |
| GHSA-5r6x-g6jv-4v87 | ibexa/admin-ui | Ibexa Admin UI XSS vulnerabilities in back office | medium | 0.0 | – |
| GHSA-63cr-xg3f-8jvr | leantime/leantime | Leantime allows Stored Cross-Site Scripting (XSS) | medium | 0.0 | – |
| GHSA-6cj3-rc4p-f38f | neos/neos | Cross-site Scripting vulnerabilities in Neos | high | 0.0 | – |
| GHSA-6gv9-7q4g-pmvm | shopware/shopware | Persistent XSS in customer module in Shopware | low | 0.0 | – |
| GHSA-6jq6-x4cx-qvcm | grumpydictator/firefly-iii | Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig) | medium | 0.0 | – |
| GHSA-74j9-xhqr-6qv3 | silverstripe/framework | Reflected Cross Site Scripting (XSS) in error message | low | 0.0 | – |
| GHSA-76r7-h46w-463r | pimcore/pimcore | Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug | medium | 0.0 | – |
| GHSA-8c2g-f8jm-5cr7 | ibexa/fieldtype-richtext | ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text | medium | 0.0 | – |
| GHSA-8j9v-4hhh-x43c | typo3/cms | Cross-Site Scripting (XSS) in TYPO3 component CSS styled content | medium | 0.0 | – |
| GHSA-99c7-c3mw-mxhv | ezsystems/ezplatform-admin-ui | ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal | medium | 0.0 | – |
| GHSA-9cq2-pcgr-8h62 | ezsystems/ezfind-ls | Cross-site Scripting in eZFind spellcheck | high | 0.0 | – |
| GHSA-9qv6-4pwm-m68f | ibexa/fieldtype-richtext | Ibexa RichText Field Type XSS vulnerabilities in back office | medium | 0.0 | – |
| GHSA-c39w-3pjx-qc7m | leantime/leantime | Leantime allows Stored Cross-Site Scripting (XSS) | high | 0.0 | – |
| GHSA-f679-254h-qhvj | leantime/leantime | Leantime allows Cross-Site Scripting (XSS) | low | 0.0 | – |
| GHSA-f6p7-8xfw-fjqq | shopware/shopware | Authenticated Stored XSS in Administration | medium | 0.0 | – |
| GHSA-fxwm-rx68-p5vx | ezsystems/ezplatform-richtext | XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext | medium | 0.0 | – |
| GHSA-hq37-rfjc-mr8h | typo3/cms | Cross-Site Scripting (XSS) in TYPO3 Backend | medium | 0.0 | – |
| GHSA-hrfh-fp4x-crrq | shopware/shopware | Persistent XSS in newsletter module in Shopware | low | 0.0 | – |
| GHSA-hwmc-r6mf-jh83 | spatie/schema-org | Schema.org has cross-site scripting (XSS) via script break-out in toScript() output | low | 0.0 | – |
| GHSA-jfxf-4frr-9j3q | neos/neos | XSS in various backend modules due to (un)escaping in JS notification module | medium | 0.0 | – |
| GHSA-jq9q-6p42-qpr7 | ezsystems/ezdemo-ls-extension | Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS | high | 0.0 | – |
| GHSA-jxcx-3h54-qqxx | silverstripe/admin | SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE | medium | 0.0 | – |
| GHSA-mg4c-884j-pcq9 | leantime/leantime | Leantime allows Stored Cross-Site Scripting (XSS) | medium | 0.0 | – |