Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-5301 | magento/community-edition | Magento Cross-Site Request Forgery (CSRF) | medium | 6.5 | 0% |
| CVE-2022-2388 | wp-coder (WordPress plugin) | The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow att | medium | 6.5 | 0% |
| CVE-2023-5076 | ziteboard-online-whiteboard (WordPress plugin) | The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions | medium | 6.4 | 0% |
| CVE-2023-5096 | hk-filter-and-search (WordPress plugin) | The HTML filter and csv-file search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'csvsearch' shortcode | medium | 6.4 | 0% |
| CVE-2023-5507 | imagemapper (WordPress plugin) | The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, | medium | 6.4 | 0% |
| CVE-2023-5567 | qr-code-tag (WordPress plugin) | The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and including | medium | 6.4 | 0% |
| CVE-2023-5742 | easyrotator-for-wordpress (WordPress plugin) | The EasyRotator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyrotator' shortcode in | medium | 6.4 | 0% |
| CVE-2023-6934 | limit-login-attempts-reloaded (WordPress plugin) | The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all ver | medium | 6.4 | 0% |
| CVE-2024-11385 | pure-css-circle-progress-bar (WordPress plugin) | The Pure CSS Circle Progress bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'circle_progress' shortc | medium | 6.4 | 0% |
| CVE-2024-1449 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slide shor | medium | 6.4 | 0% |
| CVE-2024-1697 | add-fields-to-checkout-page-woocommerce (WordPress plugin) | The Custom WooCommerce Checkout Fields Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the save_wcfe_options fu | medium | 6.4 | 0% |
| CVE-2024-2141 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all | medium | 6.4 | 0% |
| CVE-2024-2142 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Info Table widget in | medium | 6.4 | 0% |
| CVE-2024-2144 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widg | medium | 6.4 | 0% |
| CVE-2024-2202 | siteorigin-panels (WordPress plugin) | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions | medium | 6.4 | 0% |
| CVE-2024-2799 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Tex | medium | 6.4 | 0% |
| CVE-2024-3988 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-11376 | s2member (WordPress plugin) | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vu | medium | 6.1 | 0% |
| CVE-2024-4096 | responsive-tabs (WordPress plugin) | The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege u | medium | 5.9 | 0% |
| CVE-2024-13924 | starter-templates (WordPress plugin) | The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and includin | medium | 5.3 | 0% |
| CVE-2024-39325 | aimeos/ai-controller-frontend | ai-controller-frontend payment status in basket isn't reset | medium | 5.3 | 0% |
| CVE-2024-4750 | buddyboss (WordPress plugin) | The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulatin | medium | 5.3 | 0% |
| CVE-2023-6005 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which co | medium | 4.8 | 0% |
| CVE-2023-6046 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 4.8 | 0% |
| CVE-2025-51487 | moonshine/moonshine | moonshine Stored Cross-Site Scripting Vulnerability in Create Article | medium | 4.5 | 0% |
| CVE-2022-40130 | wp-polls (WordPress plugin) | Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress. | medium | 4.3 | 0% |
| CVE-2026-44175 | getkirby/cms | Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend | high | 0.0 | 0% |
| CVE-2024-51093 | snipe/snipe-it | Cross Site Scripting vulnerability in Snipe-IT | high | 8.7 | 0% |
| CVE-2026-23997 | facturascripts/facturascripts | FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View | high | 8.0 | 0% |
| CVE-2021-25013 | qubely (WordPress plugin) | The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does n | medium | 6.5 | 0% |
| CVE-2022-1570 | files-download-delay (WordPress plugin) | The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could a | medium | 6.5 | 0% |
| CVE-2024-1235 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom class field in all version | medium | 6.4 | 0% |
| CVE-2024-1496 | featured-image-from-url (WordPress plugin) | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all | medium | 6.4 | 0% |
| CVE-2024-2436 | lightweight-accordion (WordPress plugin) | The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 0% |
| CVE-2024-2504 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attr' | medium | 6.4 | 0% |
| CVE-2024-3161 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's attributes in all version | medium | 6.4 | 0% |
| CVE-2024-3680 | enteraddons (WordPress plugin) | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animati | medium | 6.4 | 0% |
| CVE-2024-3831 | enteraddons (WordPress plugin) | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading | medium | 6.4 | 0% |
| CVE-2024-4209 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-4335 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textAlign’ parameter in | medium | 6.4 | 0% |
| CVE-2024-4383 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_li | medium | 6.4 | 0% |
| CVE-2024-4487 | blocksy-companion (WordPress plugin) | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2. | medium | 6.4 | 0% |
| CVE-2023-49146 | rhukster/dom-sanitizer | Cross-site Scripting in DOMSanitizer | medium | 6.1 | 0% |
| CVE-2024-42354 | shopware/core, shopware/platform | Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api | medium | 5.3 | 0% |
| CVE-2024-8968 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow hi | medium | 4.7 | 0% |
| CVE-2021-36890 | social-share-buttons-by-supsystic (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress. | medium | 4.3 | 0% |
| CVE-2022-0345 | customize-wordpress-emails-and-alerts (WordPress plugin) | The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users | medium | 4.3 | 0% |
| CVE-2022-0875 | google-authenticator (WordPress plugin) | The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as e | medium | 4.3 | 0% |
| CVE-2022-1092 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowi | medium | 4.3 | 0% |
| CVE-2022-1573 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 4.3 | 0% |