Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-21612 | starcitizentools/tabber-neue | Extension:TabberNeue vulnerable to Cross-site Scripting | high | 8.6 | 1% |
| CVE-2024-4448 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 1% |
| CVE-2024-31828 | lavalite/cms | Lavalite CMS Cross Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2024-8797 | wp-booking-system (WordPress plugin) | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_ar | medium | 6.1 | 1% |
| CVE-2024-11606 | tabs-shortcode (WordPress plugin) | The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.3 | 1% |
| CVE-2021-24570 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The | medium | 4.3 | 1% |
| CVE-2023-2191 | azuracast/azuracast | AzuraCast/AzuraCast vulnerable to cross-site scripting | low | 3.5 | 1% |
| CVE-2023-2102 | alextselegidis/easyappointments | alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting | medium | 6.8 | 1% |
| CVE-2022-33155 | ameos/ameos_tarteaucitron | Cross site scripting in ameos_tarteaucitron | medium | 5.4 | 1% |
| CVE-2023-0274 | url-params (WordPress plugin) | The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a pa | medium | 5.4 | 1% |
| CVE-2026-55890 | getgrav/grav | Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr | medium | 4.8 | 1% |
| CVE-2024-1128 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and includi | medium | 5.4 | 1% |
| CVE-2024-2765 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.4 | 1% |
| CVE-2024-28190 | contao/core-bundle | Contao: Cross site scripting in the file manager | medium | 5.4 | 1% |
| CVE-2024-34356 | typo3/cms-core | TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module | medium | 5.4 | 1% |
| CVE-2024-34357 | typo3/cms-core | TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController | medium | 5.4 | 1% |
| CVE-2025-31675 | drupal/core | Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-3669 | web-directory-free (WordPress plugin) | The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.8 | 1% |
| CVE-2023-5071 | sitekit (WordPress plugin) | The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekit_iframe' shortcode in versions up to, and includin | medium | 6.4 | 1% |
| CVE-2024-0896 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link parameter | medium | 6.4 | 1% |
| CVE-2024-0966 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions u | medium | 6.4 | 1% |
| CVE-2024-1326 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and i | medium | 6.4 | 1% |
| CVE-2024-1391 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eae_custom_overlay_switcher’ attribu | medium | 6.4 | 1% |
| CVE-2024-1393 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content | medium | 6.4 | 1% |
| CVE-2024-1450 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions u | medium | 6.4 | 1% |
| CVE-2024-1585 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) i | medium | 6.4 | 1% |
| CVE-2024-1723 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to | medium | 6.4 | 1% |
| CVE-2024-2026 | content-protector (WordPress plugin) | The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortcode in all versions | medium | 6.4 | 1% |
| CVE-2020-36608 | tribalsystems/zenario | Tribal Systems Zenario CMS vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2023-5307 | contest-gallery (WordPress plugin) | The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauth | medium | 6.1 | 1% |
| CVE-2022-37251 | craftcms/cms | Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts | medium | 5.4 | 1% |
| CVE-2024-1846 | responsive-tabs (WordPress plugin) | The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2023-1525 | site-reviews (WordPress plugin) | The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2023-1614 | wp-custom-author-url (WordPress plugin) | The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 1% |
| CVE-2020-36704 | fruitful-theme (WordPress theme) | The Fruitful Theme for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters stored via the fruitful_theme_options_a | medium | 6.4 | 0% |
| CVE-2024-13183 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions u | medium | 6.4 | 0% |
| CVE-2024-1422 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the modal popup widget's effect setting i | medium | 6.4 | 0% |
| CVE-2016-15022 | mos/cimage | CImage Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2022-3516 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 6.1 | 0% |
| CVE-2020-36396 | lavalite/cms | Stored XSS in LavaLite 5.8.0 | medium | 5.4 | 0% |
| CVE-2022-1340 | yetiforce/yetiforce-crm | Cross site scripting in yetiforce/yetiforce-crm | medium | 5.4 | 0% |
| CVE-2022-26375 | ab-press-optimizer-lite (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology AB Press Optimizer plugin <= 1.1.1 on WordPress. | medium | 4.8 | 0% |
| CVE-2024-2836 | super-socializer (WordPress plugin) | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings | medium | 4.8 | 0% |
| CVE-2024-4977 | index-wp-mysql-for-speed (WordPress plugin) | The Index WP MySQL For Speed WordPress plugin before 1.4.18 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.8 | 0% |
| CVE-2024-5555 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-1956 | wpb-show-core (WordPress plugin) | The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an un | medium | 6.1 | 0% |
| CVE-2023-46068 | maileon (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XQueue GmbH Maileon for WordPress plugin <= 2.16.0 versions. | medium | 5.9 | 0% |
| CVE-2024-1292 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading | medium | 4.7 | 0% |
| CVE-2023-45640 | wp-ulike (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TechnoWich WP ULike – Most Advanced WordPress Marketing Toolkit plug | medium | 6.5 | 0% |
| CVE-2023-5338 | theme-blvd-shortcodes (WordPress plugin) | The Theme Blvd Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, | medium | 6.4 | 0% |