Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6169 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 1% |
| CVE-2023-5560 | wp-useronline (WordPress plugin) | The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on th | medium | 6.1 | 1% |
| CVE-2023-5653 | wassup-real-time-analytics (WordPress plugin) | The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them | medium | 6.1 | 1% |
| CVE-2023-5958 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an un | medium | 6.1 | 1% |
| CVE-2023-1116 | pimcore/pimcore | Pimcore vulnerable to Cross Site Scripting in Email Blacklist | medium | 5.4 | 1% |
| CVE-2023-47379 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-1754 | nps-computy (WordPress plugin) | The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.7 | 1% |
| CVE-2021-36864 | quiz-master-next (WordPress plugin) | Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress. | low | 3.4 | 1% |
| CVE-2025-62671 | mediawiki/cargo | Cargo Mediawiki Extension vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2024-0254 | guest-author-name (WordPress plugin) | The (Simply) Guest Author Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post meta in all versions | medium | 6.4 | 1% |
| CVE-2024-1237 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the flyout_layout attribute in a | medium | 6.4 | 1% |
| CVE-2024-1392 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button1_icon' attribute of the Dual | medium | 6.4 | 1% |
| CVE-2024-3244 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 1% |
| CVE-2023-5140 | bonus-for-woo (WordPress plugin) | The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading t | medium | 6.1 | 1% |
| CVE-2023-5609 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, l | medium | 6.1 | 1% |
| CVE-2021-43561 | pegasus/google-for-jobs | Cross-site Scripting in pegasus/google-for-jobs | medium | 5.4 | 1% |
| CVE-2023-0308 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-0309 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-2323 | pimcore/pimcore | Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field | medium | 6.8 | 1% |
| CVE-2022-46848 | visualizer (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin | medium | 6.5 | 1% |
| CVE-2023-1404 | show-posts (WordPress plugin) | The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display | medium | 6.4 | 1% |
| CVE-2023-4718 | font-awesome-4-menus (WordPress plugin) | The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in version | medium | 6.4 | 1% |
| CVE-2023-4772 | newsletter (WordPress plugin) | The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2023-5051 | callrail-phone-call-tracking (WordPress plugin) | The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in vers | medium | 6.4 | 1% |
| CVE-2023-5062 | wp-charts (WordPress plugin) | The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in versions up to, and incl | medium | 6.4 | 1% |
| CVE-2023-5063 | youtube-widget-responsive (WordPress plugin) | The Widget Responsive for Youtube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube' shortcode in versions up t | medium | 6.4 | 1% |
| CVE-2023-5252 | fareharbor (WordPress plugin) | The FareHarbor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.7 due | medium | 6.4 | 1% |
| CVE-2023-5291 | blog-filter (WordPress plugin) | The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'AWL-BlogFilter' shortcode in versions up to, and incl | medium | 6.4 | 1% |
| CVE-2023-5614 | theme-switcha (WordPress plugin) | The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'theme_switcha_list' shortcode in all v | medium | 6.4 | 1% |
| CVE-2023-5705 | vk-filter-search (WordPress plugin) | The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all | medium | 6.4 | 1% |
| CVE-2024-3167 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitter_username’ parameter in versions up to, an | medium | 6.4 | 1% |
| CVE-2021-36887 | tarteaucitronjs (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & | medium | 6.1 | 1% |
| CVE-2023-27918 | ameliabooking (WordPress plugin) | Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote | medium | 6.1 | 1% |
| CVE-2023-38500 | typo3/html-sanitizer | By-passing Cross-Site Scripting Protection in HTML Sanitizer | medium | 4.7 | 1% |
| CVE-2024-29179 | phpmyfaq/phpmyfaq | phpMyFAQ Stored Cross-site Scripting at File Attachments | medium | 4.3 | 1% |
| CVE-2022-36745 | librenms/librenms | LibreNMS vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-36746 | librenms/librenms | LibreNMS vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2024-45060 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file | medium | 6.1 | 1% |
| CVE-2020-36656 | spectra (WordPress plugin) | The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to con | medium | 5.4 | 1% |
| CVE-2021-24685 | flat-preloader (WordPress plugin) | The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and es | medium | 5.4 | 1% |
| CVE-2022-4667 | rss-aggregator-by-feedzy (WordPress plugin) | The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them bac | medium | 5.4 | 1% |
| CVE-2023-0219 | fluentsmtp (WordPress plugin) | The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting | medium | 5.4 | 1% |
| CVE-2023-2300 | contact-form-with-a-meeting-scheduler-by-vcita (WordPress plugin) | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up | medium | 6.4 | 1% |
| CVE-2024-1398 | ultimate-bootstrap-elements-for-elementor (WordPress plugin) | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ | medium | 6.4 | 1% |
| CVE-2021-24567 | simple-post (WordPress plugin) | The Simple Post WordPress plugin through 1.1 does not sanitize user input when an authenticated user Text value, then it does not escape the | medium | 5.4 | 1% |
| CVE-2021-24584 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any us | medium | 5.4 | 1% |
| CVE-2022-40408 | feehi/feehicms | FeehiCMS vulnerable to Cross-Site scripting via crafted payload | medium | 5.4 | 1% |
| CVE-2024-1989 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Sassy_Soc | medium | 6.4 | 1% |
| CVE-2024-10519 | wish-list-for-woocommerce (WordPress plugin) | The Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the | medium | 6.1 | 1% |
| CVE-2023-2718 | contact-form-email (WordPress plugin) | The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stor | medium | 5.4 | 1% |