Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2031 | video-conferencing-with-zoom-api (WordPress plugin) | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meet | medium | 6.4 | 0% |
| CVE-2024-2079 | addons-for-visual-composer (WordPress plugin) | The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mo | medium | 6.4 | 0% |
| CVE-2024-2084 | ht-mega (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox widg | medium | 6.4 | 0% |
| CVE-2024-2085 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' value in severa | medium | 6.4 | 0% |
| CVE-2024-2132 | ultimate-bootstrap-elements-for-elementor (WordPress plugin) | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Widget in all | medium | 6.4 | 0% |
| CVE-2024-2136 | wpkoi-templates-for-elementor (WordPress plugin) | The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget in all v | medium | 6.4 | 0% |
| CVE-2024-2137 | widgetkit-for-elementor (WordPress plugin) | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widge | medium | 6.4 | 0% |
| CVE-2024-2249 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute foun | medium | 6.4 | 0% |
| CVE-2024-2273 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several | medium | 6.4 | 0% |
| CVE-2024-2308 | elementinvader-addons-for-elementor (WordPress plugin) | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link in the EliSlid | medium | 6.4 | 0% |
| CVE-2024-2750 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button wid | medium | 6.4 | 0% |
| CVE-2024-2751 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_st | medium | 6.4 | 0% |
| CVE-2024-2781 | elementor-pro (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_html_tag attribute in all | medium | 6.4 | 0% |
| CVE-2024-2790 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Accordion widget in all ve | medium | 6.4 | 0% |
| CVE-2024-2791 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all | medium | 6.4 | 0% |
| CVE-2024-2839 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode i | medium | 6.4 | 0% |
| CVE-2024-2842 | easy-appointments (WordPress plugin) | The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-3162 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all version | medium | 6.4 | 0% |
| CVE-2024-3245 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-3309 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget's attributes in all v | medium | 6.4 | 0% |
| CVE-2024-3344 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-3490 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in | medium | 6.4 | 0% |
| CVE-2024-3560 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up | medium | 6.4 | 0% |
| CVE-2024-3598 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all version | medium | 6.4 | 0% |
| CVE-2024-3672 | ba-book-everything (WordPress plugin) | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-3732 | geodirectory (WordPress plugin) | The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scri | medium | 6.4 | 0% |
| CVE-2024-3883 | interactive-3d-flipbook-powered-physics-engine (WordPress plugin) | The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-9702 | social-rocket (WordPress plugin) | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-f | medium | 6.4 | 0% |
| CVE-2023-2528 | contact-form-by-supsystic (WordPress plugin) | The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. Thi | medium | 5.4 | 0% |
| CVE-2024-10520 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'che | medium | 5.3 | 0% |
| CVE-2025-1363 | url-shortener-\|-conversion-tracking-\|-ab-testing-\|-woocommerce (WordPress plugin) | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its | low | 3.5 | 0% |
| CVE-2026-42458 | openmage/magento-lts | Magento LTS: Reflected XSS - Import -> Data Flow (profiles) | medium | 0.0 | 0% |
| CVE-2026-34557 | ci4-cms-erp/ci4ms | CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-34558 | ci4-cms-erp/ci4ms | CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2023-0824 | userplus (WordPress plugin) | The User registration & user profile WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as we | medium | 6.5 | 0% |
| CVE-2024-1756 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenti | medium | 6.5 | 0% |
| CVE-2024-12597 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_css' and 'inner | medium | 6.4 | 0% |
| CVE-2025-2541 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2025-5235 | opensheetmusicdisplay (WordPress plugin) | The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2025-3597 | firelight-lightbox (WordPress plugin) | The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascr | medium | 5.9 | 0% |
| CVE-2021-24388 | vikrentcar-car-rental-management-system (WordPress plugin) | In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the | medium | 5.4 | 0% |
| CVE-2021-24611 | keyword-meta (WordPress plugin) | The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they ar | medium | 5.4 | 0% |
| CVE-2021-36861 | rich-reviews (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete revie | medium | 5.4 | 0% |
| CVE-2023-5548 | moodle/moodle | Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability | medium | 5.3 | 0% |
| CVE-2025-32045 | moodle/moodle | Moodle shows hidden grades to users without permission on some grade reports | medium | 5.3 | 0% |
| CVE-2026-43881 | wwbn/avideo | AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restricti | medium | 5.3 | 0% |
| CVE-2024-6703 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.9 | 0% |
| CVE-2024-5447 | paypal-pay-now\,-buy-now\,-donation-and-cart-buttons-shortcode (WordPress plugin) | The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its setti | medium | 4.8 | 0% |
| CVE-2024-2963 | pocket-news-generator (WordPress plugin) | The Pocket News Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as "Consumer Key" and "A | medium | 4.4 | 0% |
| CVE-2024-2968 | wp-eggdrop (WordPress plugin) | The WP-Eggdrop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0. | medium | 4.4 | 0% |