Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-40597 | mantisbt/mantisbt | MantisBT has a Content Security Policy bypass via attachments | high | 0.0 | 0% |
| CVE-2021-36785 | miniorange/miniorange-saml | Cross-site Scripting in TYPO3 extension | high | 8.5 | 0% |
| CVE-2023-2615 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) in Predefined Properties delete | medium | 6.8 | 0% |
| CVE-2023-2616 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) in Static Routes name field | medium | 6.8 | 0% |
| CVE-2024-0559 | enhanced-text-widget (WordPress plugin) | The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back i | medium | 6.5 | 0% |
| CVE-2023-33495 | craftcms/cms | Craft CMS vulnerable to HTML injection | medium | 6.1 | 0% |
| CVE-2024-8274 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in a | medium | 6.1 | 0% |
| CVE-2022-3836 | seed-social (WordPress plugin) | The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-3703 | carousel-slider (WordPress plugin) | The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the | medium | 4.7 | 0% |
| CVE-2023-3082 | post-smtp (WordPress plugin) | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 d | high | 7.2 | 0% |
| CVE-2024-0838 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the side image URL parameter in the Age | medium | 6.4 | 0% |
| CVE-2023-46722 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews | medium | 6.1 | 0% |
| CVE-2017-8762 | genix/cms | GeniXCMS Cross-site Scripting (XSS) | medium | 5.4 | 0% |
| CVE-2024-1412 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ and 'error' parameters in all version | medium | 6.1 | 0% |
| CVE-2024-2200 | contact-form-plugin (WordPress plugin) | The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ para | medium | 6.1 | 0% |
| CVE-2022-3987 | responsive-lightbox2 (WordPress plugin) | The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2024-2428 | presto-player (WordPress plugin) | The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via | medium | 4.7 | 0% |
| CVE-2023-5715 | plerdy-heatmap (WordPress plugin) | The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings | medium | 4.4 | 0% |
| CVE-2024-0597 | seo-plugin-by-squirrly-seo (WordPress plugin) | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to an | medium | 4.4 | 0% |
| CVE-2024-0612 | content-views (WordPress plugin) | The Content Views – Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 4.4 | 0% |
| CVE-2024-4863 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-8665 | yith-custom-login (WordPress plugin) | The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria | medium | 6.1 | 0% |
| CVE-2024-9347 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' | medium | 6.1 | 0% |
| CVE-2023-2735 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions up to, and includin | medium | 4.9 | 0% |
| CVE-2024-34000 | moodle/moodle | Moodle Cross-site Scripting (XSS) | medium | 4.3 | 0% |
| CVE-2023-1881 | microweber/microweber | Microweber vulnerable to stored cross-site scripting (XSS) via X-Forwarded-For header | high | 7.4 | 0% |
| CVE-2024-2792 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2024-4862 | wpbits-addons-for-elementor (WordPress plugin) | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all ve | medium | 6.4 | 0% |
| CVE-2023-2296 | loginizer (WordPress plugin) | The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross- | medium | 6.1 | 0% |
| CVE-2020-20696 | gilacms/gila | Cross-site Scripting in GilaCMS | medium | 5.4 | 0% |
| CVE-2023-4799 | magic-embeds (WordPress plugin) | The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2022-3838 | wpupper-share-buttons (WordPress plugin) | The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2023-6737 | enable-media-replace (WordPress plugin) | The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all vers | medium | 4.7 | 0% |
| CVE-2023-4007 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | high | 8.8 | 0% |
| CVE-2026-55690 | starcitizenwiki/embedvideo | StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text | high | 7.5 | 0% |
| CVE-2026-55692 | starcitizenwiki/embedvideo | StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled | high | 7.5 | 0% |
| CVE-2023-3092 | smtp-mail (WordPress plugin) | The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.4 | high | 7.2 | 0% |
| CVE-2022-31037 | oro/commerce | OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration | medium | 6.9 | 0% |
| CVE-2023-5050 | leaflet-map (WordPress plugin) | The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due | medium | 6.4 | 0% |
| CVE-2024-1664 | responsive-gallery-grid (WordPress plugin) | The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privile | medium | 6.1 | 0% |
| CVE-2024-3026 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users w | medium | 5.4 | 0% |
| CVE-2022-30545 | 5-anker-connect (WordPress plugin) | Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-32776 | advanced-ads (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on | medium | 4.8 | 0% |
| CVE-2022-41980 | mantenimiento-web (WordPress plugin) | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress. | medium | 4.8 | 0% |
| CVE-2023-4808 | wp-post-popup (WordPress plugin) | The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-4970 | pubydoc (WordPress plugin) | The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-45127 | magento/community-edition | Magento Open Source stored Cross-Site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2023-4160 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, | medium | 4.4 | 0% |
| CVE-2023-5381 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and inc | medium | 4.4 | 0% |
| CVE-2024-4350 | concrete5/concrete5 | Concrete CMS Stored Cross-site Scripting vulnerability | low | 3.0 | 0% |