Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-62415 | bagisto/bagisto | bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML) | medium | 6.9 | 0% |
| CVE-2025-62418 | bagisto/bagisto | bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG) | medium | 6.9 | 0% |
| CVE-2024-7629 | responsive-video (WordPress plugin) | The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versi | medium | 6.4 | 0% |
| CVE-2025-49137 | elmsln/haxcms | Hax CMS Stored Cross-Site Scripting vulnerability | high | 8.5 | 0% |
| CVE-2026-102279 | laravel/framework | Laravel: XSS in Debug Page Information | low | 3.1 | 0% |
| CVE-2025-4367 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all | medium | 6.4 | 0% |
| CVE-2025-11823 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Store | medium | 6.4 | 0% |
| CVE-2026-40935 | wwbn/avideo | CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure | medium | 5.3 | 0% |
| CVE-2025-11160 | page-builder (WordPress plugin) | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, | medium | 6.4 | 0% |
| CVE-2025-11161 | page-builder (WordPress plugin) | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_custom_heading shortcode in all versi | medium | 6.4 | 0% |
| CVE-2026-35453 | phpoffice/phpspreadsheet | PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer | medium | 0.0 | 0% |
| GHSA-ww6p-q26w-fr6m | phpxmlrpc/extras | phpxmlrpc/extra XSS in class documenting_xmlrpc_server | medium | 6.1 | – |
| GHSA-vf6x-59hh-332f | getformwork/formwork | Formwork has a cross-site scripting (XSS) vulnerability in Site title | medium | 4.7 | – |