Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-0954 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-1411 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of the Twitter Buttons | medium | 6.4 | 0% |
| CVE-2024-1413 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer widget in all v | medium | 6.4 | 0% |
| CVE-2024-1414 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in all ve | medium | 6.4 | 0% |
| CVE-2024-1424 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sho | medium | 6.4 | 0% |
| CVE-2024-1458 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘text_alignment’ attribute of the | medium | 6.4 | 0% |
| CVE-2024-1461 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Team Mem | medium | 6.4 | 0% |
| CVE-2024-1464 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Posts Sl | medium | 6.4 | 0% |
| CVE-2024-1465 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘carousel_skin’ attribute of the | medium | 6.4 | 0% |
| CVE-2024-1466 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_style’ attribute of the P | medium | 6.4 | 0% |
| CVE-2024-1680 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Settings URL of the Banner, | medium | 6.4 | 0% |
| CVE-2024-1854 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2024-2000 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi Sc | medium | 6.4 | 0% |
| CVE-2024-2027 | real-media-library-lite (WordPress plugin) | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style | medium | 6.4 | 0% |
| CVE-2024-2126 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Registration Form widget in all version | medium | 6.4 | 0% |
| CVE-2024-2138 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions u | medium | 6.4 | 0% |
| CVE-2024-2165 | wp-seopress (WordPress plugin) | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-2181 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions | medium | 6.4 | 0% |
| CVE-2024-2183 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions | medium | 6.4 | 0% |
| CVE-2024-2185 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versio | medium | 6.4 | 0% |
| CVE-2024-2186 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Members widget in all ver | medium | 6.4 | 0% |
| CVE-2024-2187 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all ver | medium | 6.4 | 0% |
| CVE-2024-2237 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-2238 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions | medium | 6.4 | 0% |
| CVE-2024-2239 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions | medium | 6.4 | 0% |
| CVE-2024-2286 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart) plugin for | medium | 6.4 | 0% |
| CVE-2024-3308 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget's at | medium | 6.4 | 0% |
| CVE-2024-3337 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_breadcrumb_element' sho | medium | 6.4 | 0% |
| CVE-2024-3650 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver | medium | 6.4 | 0% |
| CVE-2024-3725 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-3747 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versio | medium | 6.4 | 0% |
| CVE-2024-3885 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subcontainer value parameter in a | medium | 6.4 | 0% |
| CVE-2024-3891 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in widgets in all versions up | medium | 6.4 | 0% |
| CVE-2024-3985 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Call to Action widget | medium | 6.4 | 0% |
| CVE-2024-3991 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-4092 | slider-revolution (WordPress plugin) | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmltag’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-9059 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all | medium | 6.4 | 0% |
| CVE-2024-9668 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget | medium | 6.4 | 0% |
| CVE-2025-24027 | prestashop/ps_contactinfo | ps_contactinfo has a potential XSS due to usage of the nofilter tag in template | medium | 6.2 | 0% |
| CVE-2022-25274 | drupal/core | Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated | medium | 5.4 | 0% |
| CVE-2023-6738 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagel | medium | 5.4 | 0% |
| CVE-2024-0823 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' url in carousels in a | medium | 5.4 | 0% |
| CVE-2024-1171 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 5.4 | 0% |
| CVE-2024-12316 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_a | medium | 5.3 | 0% |
| CVE-2024-8513 | qa-heatmap-analytics (WordPress plugin) | The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized mod | medium | 5.3 | 0% |
| CVE-2024-13119 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 | medium | 4.8 | 0% |
| CVE-2024-2309 | wp-staging (WordPress plugin) | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and es | medium | 4.8 | 0% |
| CVE-2024-5002 | user-submitted-posts (WordPress plugin) | The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2022-27846 | yoo-slider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider. | medium | 4.3 | 0% |
| CVE-2024-1330 | kadence-blocks-pro (WordPress plugin) | The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's | medium | 4.3 | 0% |