Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5110 | bsk-pdf-manager (WordPress plugin) | The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions | medium | 6.4 | 1% |
| CVE-2023-5665 | payment-forms-for-paystack (WordPress plugin) | The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions | medium | 6.4 | 1% |
| CVE-2021-39332 | business-manager (WordPress plugin) | The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization fou | medium | 5.5 | 1% |
| CVE-2022-36341 | as-create-pinterest-pinboard-pages (WordPress plugin) | Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pi | medium | 5.4 | 1% |
| CVE-2024-0449 | artibot (WordPress plugin) | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all | medium | 4.4 | 1% |
| CVE-2022-3829 | font-awesome-4-menus (WordPress plugin) | The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-37338 | blossom-recipe-maker (WordPress plugin) | Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress | medium | 4.1 | 1% |
| CVE-2022-37339 | meet-my-team (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress. | medium | 4.1 | 1% |
| CVE-2022-40213 | gs-testimonial (WordPress plugin) | Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPres | medium | 4.1 | 1% |
| CVE-2024-21627 | prestashop/prestashop | PrestaShop some attribute not escaped in Validate::isCleanHTML method | high | 8.1 | 1% |
| CVE-2024-10850 | razorpay-payment-button-elementor (WordPress plugin) | The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer | medium | 6.1 | 1% |
| CVE-2024-8544 | facebook-conversion-pixel (WordPress plugin) | The Pixel Cat – Conversion Pixel Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_ar | medium | 6.1 | 1% |
| CVE-2024-8735 | mailmunch (WordPress plugin) | The MailMunch – Grow your Email List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg wi | medium | 6.1 | 1% |
| CVE-2017-20059 | elefant/cms | Cross site scripting in Elefant CMS | medium | 5.4 | 1% |
| CVE-2017-20060 | elefant/cms | Cross site scripting in Elefant CMS | medium | 5.4 | 1% |
| CVE-2022-37429 | silverstripe/framework | Stored XSS using HTMLEditor | medium | 5.4 | 1% |
| CVE-2023-2339 | pimcore/pimcore | Cross-site Scripting (XSS) in DataObject Any Getter grid operator | medium | 5.4 | 1% |
| CVE-2024-11223 | wpforms (WordPress plugin) | The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.7 | 1% |
| CVE-2024-27499 | bagisto/bagisto | Bagist Cross-site Scripting vulnerability | medium | 6.5 | 1% |
| CVE-2022-38462 | silverstripe/framework | Reflected XSS in querystring parameters | medium | 6.1 | 1% |
| CVE-2024-1379 | website-article-monetization-by-magenet (WordPress plugin) | The Website Article Monetization By MageNet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'abp_auth_key' paramet | medium | 6.1 | 1% |
| CVE-2024-2837 | wp-chat-app (WordPress plugin) | The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 1% |
| CVE-2021-36849 | mashsharer (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at Word | low | 3.4 | 1% |
| CVE-2022-38703 | maxbuttons (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress | low | 3.4 | 1% |
| CVE-2024-4757 | logo-manager-for-enamad (WordPress plugin) | The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as e | high | 8.1 | 1% |
| CVE-2023-0731 | interactive-geo-maps (WordPress plugin) | The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up t | medium | 6.4 | 1% |
| CVE-2023-5613 | super-testimonial (WordPress plugin) | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versio | medium | 6.4 | 1% |
| CVE-2024-0508 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table Elementor Widget | medium | 6.4 | 1% |
| CVE-2024-1960 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 1% |
| CVE-2023-2998 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to cross-site scripting | medium | 6.0 | 1% |
| CVE-2023-2168 | simple-tags (WordPress plugin) | The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and inc | medium | 5.5 | 1% |
| CVE-2023-37692 | october/october | Stored Cross-Site Scripting October CMS | medium | 5.4 | 1% |
| CVE-2022-29452 | export-all-urls (WordPress plugin) | Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin <= 4.1 at WordPress. | low | 3.4 | 1% |
| CVE-2022-37246 | craftcms/cms | Craft CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-5126 | delete-me (WordPress plugin) | The Delete Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'plugin_delete_me' shortcode in versions up to, and incl | medium | 4.9 | 1% |
| CVE-2022-36282 | search-exclude (WordPress plugin) | Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress. | medium | 4.8 | 1% |
| CVE-2025-2214 | microweber/microweber | Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler | low | 3.5 | 1% |
| CVE-2022-40215 | vc-tabs (WordPress plugin) | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress. | low | 3.4 | 1% |
| CVE-2023-4599 | email-encoder-bundle (WordPress plugin) | The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and in | medium | 6.4 | 1% |
| CVE-2023-5164 | bellows-accordion-menu (WordPress plugin) | The Bellows Accordion Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including | medium | 6.4 | 1% |
| CVE-2023-5639 | team-showcase (WordPress plugin) | The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all version | medium | 6.4 | 1% |
| CVE-2023-1804 | product-catalog-feed (WordPress plugin) | The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it | medium | 6.1 | 1% |
| CVE-2023-0608 | microweber/microweber | Microweber contains Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-37502 | automad/automad | Cross site scripting in automad/automad | medium | 4.8 | 1% |
| CVE-2024-3594 | idonate (WordPress plugin) | The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such a | high | 8.7 | 1% |
| CVE-2025-26529 | moodle/moodle | Moodle has a stored XSS risk in admin live log | high | 8.3 | 1% |
| CVE-2023-2302 | lead-capturing-call-to-actions-by-vcita (WordPress plugin) | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in | medium | 6.4 | 1% |
| CVE-2023-6701 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions u | medium | 6.4 | 1% |
| CVE-2023-6808 | ameliabooking (WordPress plugin) | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 1% |
| CVE-2024-0255 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-recipe-text-share' shortcode in | medium | 6.4 | 1% |