Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4707 | materialis-companion (WordPress plugin) | The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcod | medium | 6.4 | 0% |
| CVE-2024-4896 | wpb-elementor-addons (WordPress plugin) | The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, an | medium | 6.4 | 0% |
| CVE-2024-5038 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 0% |
| CVE-2024-5041 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ha-ia-content-button’ parameter in | medium | 6.4 | 0% |
| CVE-2024-5188 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-5220 | nd-shortcodes (WordPress plugin) | The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-5289 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-5327 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to DOM-Based Stored Cross-Sit | medium | 6.4 | 0% |
| CVE-2024-5567 | betheme (WordPress theme) | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5 | medium | 6.4 | 0% |
| CVE-2024-5628 | avada (WordPress plugin) | The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fus | medium | 6.4 | 0% |
| CVE-2024-6346 | post-grid (WordPress plugin) | The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL param | medium | 6.4 | 0% |
| CVE-2024-6363 | stock-ticker (WordPress plugin) | The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2024-7611 | enteraddons (WordPress plugin) | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' a | medium | 6.4 | 0% |
| CVE-2024-8107 | slider-revolution (WordPress plugin) | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-8960 | cowidgets-elementor-addons (WordPress plugin) | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up t | medium | 6.4 | 0% |
| CVE-2024-8961 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2024-9071 | easy-demo-importer (WordPress plugin) | The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG F | medium | 6.4 | 0% |
| CVE-2024-9072 | gdpr-consent-manager (WordPress plugin) | The GDPR-Extensions-com – Consent Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all vers | medium | 6.4 | 0% |
| CVE-2024-9708 | easy-svg-upload (WordPress plugin) | The Easy SVG Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2020-10236 | froxlor/froxlor | Froxlor Information Disclosure | medium | 6.1 | 0% |
| CVE-2023-0723 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0727 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0730 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2024-2092 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versio | medium | 5.4 | 0% |
| CVE-2024-4379 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in | medium | 5.4 | 0% |
| CVE-2024-6282 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | medium | 5.4 | 0% |
| CVE-2026-41657 | admidio/admidio | Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php | medium | 4.9 | 0% |
| CVE-2026-40301 | rhukster/dom-sanitizer | rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives | medium | 4.7 | 0% |
| CVE-2024-9306 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and incl | medium | 4.4 | 0% |
| CVE-2023-7019 | wp-maintenance-mode (WordPress plugin) | The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of d | medium | 4.3 | 0% |
| CVE-2024-0768 | envo-elementor-for-woocommerce (WordPress plugin) | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to | medium | 4.3 | 0% |
| CVE-2026-118562 | drupal/single_content_sync | Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A mal | unknown | 0.0 | 0% |
| CVE-2026-25489 | craftcms/commerce | Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-47744 | shopper/framework | Shopper: Authorization bypass and RBAC privilege escalation in team settings | critical | 9.9 | 0% |
| CVE-2023-5448 | wp-register-profile-with-shortcode (WordPress plugin) | The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3. | high | 8.8 | 0% |
| CVE-2024-10388 | wordpress-gdpr (WordPress plugin) | The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters | high | 7.2 | 0% |
| CVE-2022-40488 | processwire/processwire | ProcessWire vulnerable to Cross-Site Request Forgery | medium | 6.5 | 0% |
| CVE-2023-4455 | wallabag/wallabag | Wallabag user can delete own API client unintentionally | medium | 6.5 | 0% |
| CVE-2023-50879 | wordpress.com-editing-toolkit (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolk | medium | 6.5 | 0% |
| CVE-2023-50889 | beaver-builder (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder | medium | 6.5 | 0% |
| CVE-2023-6382 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide' sh | medium | 6.4 | 0% |
| CVE-2024-11910 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions u | medium | 6.4 | 0% |
| CVE-2024-11930 | taskbuilder (WordPress plugin) | The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi | medium | 6.4 | 0% |
| CVE-2024-4608 | sellkit (WordPress plugin) | The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross- | medium | 6.4 | 0% |
| CVE-2024-5006 | boostify-header-footer-builder (WordPress plugin) | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter | medium | 6.4 | 0% |
| CVE-2024-5092 | elegant-addons-for-elementor (WordPress plugin) | The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Switcher, Slider, and Ic | medium | 6.4 | 0% |
| CVE-2024-5259 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 6.4 | 0% |
| CVE-2024-5418 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slitems' attribute within the plugin | medium | 6.4 | 0% |
| CVE-2024-5427 | wp-cafe (WordPress plugin) | The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-5502 | piotnet-addons-for-elementor (WordPress plugin) | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual He | medium | 6.4 | 0% |