Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-35783 | tpwd/ke_search | ke_search (aka Faceted Search) vulnerable to Cross-Site Scripting | medium | 6.3 | 0% |
| CVE-2024-13711 | pollin (WordPress plugin) | The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' parameter in all versions up to, and incl | medium | 6.1 | 0% |
| CVE-2024-13822 | totalcontest (WordPress plugin) | The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting i | medium | 6.1 | 0% |
| CVE-2024-8633 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 5.5 | 0% |
| CVE-2024-12772 | ninja-tables (WordPress plugin) | The Ninja Tables WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in the page when importi | medium | 5.4 | 0% |
| CVE-2024-32674 | heateor-social-login (WordPress plugin) | Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitra | medium | 5.4 | 0% |
| CVE-2024-6551 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and | medium | 5.3 | 0% |
| CVE-2023-25985 | wordpress-tooltips (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Tomas | Docs | FAQ | Premium Support WordPress Tooltips.This issue affects WordPress Tool | medium | 4.3 | 0% |
| CVE-2023-49783 | silverstripe/admin | No permission checks for editing/deleting records with CSV import form | medium | 4.3 | 0% |
| CVE-2024-1400 | mollie-forms (WordPress plugin) | The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability check on the duplic | medium | 4.3 | 0% |
| CVE-2024-4205 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2024-47059 | mautic/core | Mautic allows users enumeration due to weak password login | medium | 4.3 | 0% |
| CVE-2024-56366 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file | high | 7.1 | 0% |
| CVE-2024-56409 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file | high | 7.1 | 0% |
| CVE-2024-0367 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link field of an installed wi | medium | 6.4 | 0% |
| CVE-2024-1054 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wcj_product_barcode' short | medium | 6.4 | 0% |
| CVE-2024-12240 | siteorigin-panels (WordPress plugin) | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions | medium | 6.4 | 0% |
| CVE-2024-1759 | wp-ulike (WordPress plugin) | The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's disp | medium | 6.4 | 0% |
| CVE-2024-1808 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode | medium | 6.4 | 0% |
| CVE-2024-2111 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physic | medium | 6.4 | 0% |
| CVE-2024-2131 | move-addons (WordPress plugin) | The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's infobox and button widget i | medium | 6.4 | 0% |
| CVE-2024-2139 | master-addons (WordPress plugin) | The Master Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in all versio | medium | 6.4 | 0% |
| CVE-2024-2140 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Icons widge | medium | 6.4 | 0% |
| CVE-2024-2143 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in al | medium | 6.4 | 0% |
| CVE-2024-2170 | vk-all-in-one-expansion-unit (WordPress plugin) | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all ve | medium | 6.4 | 0% |
| CVE-2024-2289 | powerpack-for-beaver-builder (WordPress plugin) | The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link in multiple elements in | medium | 6.4 | 0% |
| CVE-2024-2305 | cards-for-beaver-builder (WordPress plugin) | The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BootstrapCard link in all versions u | medium | 6.4 | 0% |
| CVE-2024-2336 | popup-maker (WordPress plugin) | The Popup Maker – Popup for opt-ins, lead gen, & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sho | medium | 6.4 | 0% |
| CVE-2024-2457 | modal-window (WordPress plugin) | The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) | medium | 6.4 | 0% |
| CVE-2024-2468 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-2477 | wpdiscuz (WordPress plugin) | The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all | medium | 6.4 | 0% |
| CVE-2024-2491 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the *_html_tag* attribute of multip | medium | 6.4 | 0% |
| CVE-2024-2507 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up | medium | 6.4 | 0% |
| CVE-2024-2536 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HowTo block attributes in all | medium | 6.4 | 0% |
| CVE-2024-2789 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Calendy widget in all vers | medium | 6.4 | 0% |
| CVE-2024-2841 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-2936 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute of widgets in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-2946 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-3890 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-3989 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gallery Justi | medium | 6.4 | 0% |
| CVE-2024-4158 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 2 | medium | 6.4 | 0% |
| CVE-2024-4275 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-4277 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in a | medium | 6.4 | 0% |
| CVE-2024-4316 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-4339 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-4449 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-4481 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the | medium | 6.4 | 0% |
| CVE-2024-5425 | wp-jquery-lightbox (WordPress plugin) | The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, an | medium | 6.4 | 0% |
| CVE-2025-0506 | rise-blocks (WordPress plugin) | The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the titleTag param | medium | 6.4 | 0% |
| CVE-2024-12726 | clipart (WordPress plugin) | The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec | medium | 6.1 | 0% |