Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-1403 | weaver-xtreme-theme (WordPress theme) | The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name | medium | 6.4 | 1% |
| CVE-2024-0834 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up | medium | 6.4 | 1% |
| CVE-2024-0961 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the code editor in all versions up to, a | medium | 6.4 | 1% |
| CVE-2024-1070 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the features attribute in all versions u | medium | 6.4 | 1% |
| CVE-2024-1498 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Photo Stack Widget in all | medium | 6.4 | 1% |
| CVE-2024-1999 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tes | medium | 6.4 | 1% |
| CVE-2024-3199 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions | medium | 6.4 | 1% |
| CVE-2024-3517 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion Widget | medium | 6.4 | 1% |
| CVE-2024-3819 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Banner widget in all version | medium | 6.4 | 1% |
| CVE-2023-5348 | product-catalog-mode-for-woocommerce (WordPress plugin) | The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings value | medium | 6.1 | 1% |
| CVE-2022-40000 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-40001 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-40002 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-40373 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-3922 | broken-link-checker (WordPress plugin) | The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2023-31045 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 1% |
| CVE-2024-13919 | laravel/framework | Laravel framework susceptible to reflected cross-site scripting | medium | 4.7 | 1% |
| CVE-2014-125092 | maxbuttons (WordPress plugin) | A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic. This issue affects the function maxb | low | 3.5 | 1% |
| CVE-2023-7063 | wpforms (WordPress plugin) | The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and | high | 7.2 | 1% |
| CVE-2022-33978 | fontmeister (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress. | medium | 6.1 | 1% |
| CVE-2022-2413 | slide-anything (WordPress plugin) | The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pag | medium | 5.4 | 1% |
| CVE-2023-0094 | upqode-google-maps (WordPress plugin) | The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2021-36401 | moodle/moodle | Moodle vulnerable to Stored Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2022-2353 | microweber/microweber | Microweber before v1.2.20 vulnerable to cross-site scripting | medium | 6.3 | 1% |
| CVE-2024-38356 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option | medium | 6.1 | 1% |
| CVE-2024-38357 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements | medium | 6.1 | 1% |
| CVE-2023-1325 | easy-forms-for-mailchimp (WordPress plugin) | The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting t | medium | 5.4 | 1% |
| CVE-2023-1917 | powerpress (WordPress plugin) | The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and includ | medium | 5.4 | 1% |
| CVE-2021-36833 | mailchimp-for-wp (WordPress plugin) | Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-29424 | image-hover-effects-ultimate (WordPress plugin) | Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultima | medium | 4.8 | 1% |
| CVE-2024-8680 | mailchimp-for-wp (WordPress plugin) | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up t | medium | 4.4 | 1% |
| CVE-2022-29428 | simple-slider-ssp (WordPress plugin) | Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5 at WordPress. | medium | 4.1 | 1% |
| CVE-2022-29432 | wpdatatables (WordPress plugin) | Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables | low | 3.4 | 1% |
| CVE-2024-1794 | forminator (WordPress plugin) | The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to | high | 7.2 | 1% |
| CVE-2023-5707 | seo-slider (WordPress plugin) | The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta in all ve | medium | 6.4 | 1% |
| CVE-2023-0539 | gs-insever-portfolio (WordPress plugin) | The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 1% |
| CVE-2023-5917 | phpbb/phpbb | phpBB's Smiley Pack acp_icons.php main pack vulnerable to cross site scripting | low | 2.4 | 1% |
| CVE-2024-47527 | librenms/librenms | LibreNMS has Stored Cross-site Scripting vulnerability in "Device Dependencies" feature | high | 7.5 | 1% |
| CVE-2023-5200 | flowpaper-lite-pdf-flipbook (WordPress plugin) | The flowpaper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'flipbook' shortcode in versions up to, and including, 2 | medium | 6.4 | 1% |
| CVE-2023-48300 | embed-privacy (WordPress plugin) | The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting | medium | 6.3 | 1% |
| CVE-2021-38713 | helloxz/imgurl | Cross-site scripting in imgURL | medium | 5.4 | 1% |
| CVE-2022-32280 | xo-liteslider (WordPress plugin) | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Xakuro's XO Slider plugin <= 3.3.2 at Wor | medium | 5.4 | 1% |
| CVE-2023-6485 | html5-video-player (WordPress plugin) | The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing | medium | 5.4 | 1% |
| CVE-2023-0548 | namaste\!-lms (WordPress plugin) | The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users s | medium | 4.8 | 1% |
| CVE-2022-29443 | nd-booking (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin | medium | 4.1 | 1% |
| CVE-2021-24595 | wp-cookie-choice (WordPress plugin) | The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputtin | medium | 6.5 | 1% |
| CVE-2022-25276 | drupal/core | The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed | medium | 6.1 | 1% |
| CVE-2023-4968 | wplegalpages (WordPress plugin) | The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versions up to, and includ | medium | 5.5 | 1% |
| CVE-2022-3834 | google-forms (WordPress plugin) | The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2014-125100 | job-board (WordPress plugin) | A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown c | low | 3.5 | 1% |