Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4478 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group widget in all ver | medium | 6.4 | 0% |
| CVE-2024-4580 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 0% |
| CVE-2024-4669 | events-addon-for-elementor (WordPress plugin) | The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and | medium | 6.4 | 0% |
| CVE-2024-4700 | wp-table-builder (WordPress plugin) | The WP Table Builder – WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button element in al | medium | 6.4 | 0% |
| CVE-2024-5073 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-5192 | funnel-builder (WordPress plugin) | The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells | medium | 6.4 | 0% |
| CVE-2024-5226 | fuse-social-floating-sidebar (WordPress plugin) | The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all | medium | 6.4 | 0% |
| CVE-2024-5347 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'arrow' attribute within the plugin | medium | 6.4 | 0% |
| CVE-2024-5663 | bb-bootstrap-cards (WordPress plugin) | The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Cards widget in all versions | medium | 6.4 | 0% |
| CVE-2024-5664 | mp3-music-player-by-sonaar (WordPress plugin) | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-5790 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's | medium | 6.4 | 0% |
| CVE-2024-6575 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-6627 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's PDF View widget in all ver | medium | 6.4 | 0% |
| CVE-2024-6629 | all-in-one-video-gallery (WordPress plugin) | The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-6864 | wp-last-modified-info (WordPress plugin) | The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-mod | medium | 6.4 | 0% |
| CVE-2024-6870 | responsive-lightbox (WordPress plugin) | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-6894 | integracao-rd-station (WordPress plugin) | The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insuffic | medium | 6.4 | 0% |
| CVE-2024-6896 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all vers | medium | 6.4 | 0% |
| CVE-2024-6929 | dynamic-featured-image (WordPress plugin) | The Dynamic Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘dfiFeatured’ parameter in all versions | medium | 6.4 | 0% |
| CVE-2024-7356 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-7606 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-7778 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-7791 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arrow’ parame | medium | 6.4 | 0% |
| CVE-2024-8282 | ibtana-visual-editor (WordPress plugin) | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within th | medium | 6.4 | 0% |
| CVE-2024-8318 | attributes-for-blocks (WordPress plugin) | The Attributes for Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributesForBlocks’ parameter in all v | medium | 6.4 | 0% |
| CVE-2024-8967 | iworks-pwa (WordPress plugin) | The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all vers | medium | 6.4 | 0% |
| CVE-2024-8987 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Sto | medium | 6.4 | 0% |
| CVE-2024-9388 | black-widgets (WordPress plugin) | The Black Widgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to | medium | 6.4 | 0% |
| CVE-2024-9444 | element-ready-lite (WordPress plugin) | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all version | medium | 6.4 | 0% |
| CVE-2024-9655 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-4900 | seopress (WordPress plugin) | The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above rol | medium | 6.1 | 0% |
| CVE-2025-2164 | pixelstats (WordPress plugin) | The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all version | medium | 6.1 | 0% |
| CVE-2024-3113 | simple-form (WordPress plugin) | The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escap | medium | 5.9 | 0% |
| CVE-2024-5075 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 5.9 | 0% |
| CVE-2024-5573 | easy-table-of-contents (WordPress plugin) | The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privileg | medium | 5.9 | 0% |
| CVE-2024-6390 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which coul | medium | 5.9 | 0% |
| CVE-2024-9836 | rss-feed-widget (WordPress plugin) | The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.9 | 0% |
| CVE-2021-24446 | remove-footer-credit (WordPress plugin) | The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacke | medium | 5.4 | 0% |
| CVE-2024-2375 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege us | medium | 5.4 | 0% |
| CVE-2024-10706 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2024-13439 | tlp-team (WordPress plugin) | The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the r | medium | 4.3 | 0% |
| CVE-2024-3410 | footer-contacts-bar (WordPress plugin) | The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.3 | 0% |
| CVE-2024-4957 | frontend-checklist (WordPress plugin) | The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.3 | 0% |
| CVE-2025-1504 | post-lockdown (WordPress plugin) | The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocom | medium | 4.3 | 0% |
| CVE-2026-41130 | craftcms/cms | Craft CMS has a host header injection leading to SSRF via resource-js endpoint | medium | 0.0 | 0% |
| CVE-2024-5076 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2024-8914 | bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang (WordPress plugin) | The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross | high | 7.2 | 0% |
| CVE-2024-5945 | wp-svg-images (WordPress plugin) | The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2023-50896 | weforms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weForms weForms – Easy Drag & Drop Con | medium | 5.9 | 0% |
| CVE-2024-2953 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, a | medium | 5.5 | 0% |