Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-0672 | pz-linkcard (WordPress plugin) | The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a | high | 7.1 | 0% |
| CVE-2023-7225 | mappress-google-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all | medium | 6.4 | 0% |
| CVE-2022-4369 | wp-lister-lite-for-amazon (WordPress plugin) | The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, | medium | 6.1 | 0% |
| CVE-2024-8549 | google-calendar-events (WordPress plugin) | The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer | medium | 6.1 | 0% |
| CVE-2022-28612 | m-wp-popup (WordPress plugin) | Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) | medium | 5.4 | 0% |
| CVE-2022-3194 | dokan (WordPress plugin) | The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored | medium | 5.4 | 0% |
| CVE-2024-0621 | simple-share-buttons-adder (WordPress plugin) | The Simple Share Buttons Adder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, a | medium | 4.4 | 0% |
| CVE-2022-4651 | justified-gallery (WordPress plugin) | The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users wi | medium | 5.4 | 0% |
| CVE-2022-4788 | embed-pdf (WordPress plugin) | The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a | medium | 5.4 | 0% |
| CVE-2023-43340 | evolutioncms/evolution | Evolution CMS Cross-site Scripting vulnerability | medium | 5.2 | 0% |
| CVE-2023-48650 | concrete5/concrete5 | Concrete CMS Stored XSS in Layout Preset Name | medium | 4.8 | 0% |
| CVE-2024-52526 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php | high | 7.5 | 0% |
| CVE-2024-4268 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in a | medium | 6.4 | 0% |
| CVE-2024-5032 | sully (WordPress plugin) | The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect | medium | 4.7 | 0% |
| CVE-2023-45829 | newsletter-\&-bulk-email-sender (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin fo | medium | 6.5 | 0% |
| CVE-2021-4378 | wp-quick-frontend-editor (WordPress plugin) | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to | medium | 6.4 | 0% |
| CVE-2023-2031 | locatoraid (WordPress plugin) | The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up | medium | 5.4 | 0% |
| CVE-2021-36573 | feehi/feehicms | FeehiCMS Unrestricted Upload vulnerability | medium | 5.4 | 0% |
| CVE-2024-7398 | concrete5/concrete5 | Cross site scripting in Concrete CMS | medium | 5.4 | 0% |
| CVE-2021-41948 | intelliants/subrion | Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin | medium | 4.8 | 0% |
| CVE-2023-4944 | awesome-weather (WordPress plugin) | The Awesome Weather Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up | medium | 6.4 | 0% |
| CVE-2024-1323 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Type Grid Widget Title in | medium | 6.4 | 0% |
| CVE-2024-4430 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo widget crop attr | medium | 6.4 | 0% |
| CVE-2023-2169 | simple-tags (WordPress plugin) | The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and i | medium | 5.5 | 0% |
| CVE-2023-2170 | simple-tags (WordPress plugin) | The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and i | medium | 5.5 | 0% |
| CVE-2023-5109 | wp-mailto-links (WordPress plugin) | The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode | medium | 6.4 | 0% |
| CVE-2023-5704 | cpo-shortcodes (WordPress plugin) | The CPO Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and | medium | 6.4 | 0% |
| CVE-2023-5708 | wp-post-columns (WordPress plugin) | The WP Post Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'column' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2022-44069 | tribalsystems/zenario | Cross-site Scripting in Zenario | medium | 5.4 | 0% |
| CVE-2022-44070 | tribalsystems/zenario | Cross-site Scripting in Zenario | medium | 5.4 | 0% |
| CVE-2022-44071 | tribalsystems/zenario | Cross-site Scripting in Zenario | medium | 5.4 | 0% |
| CVE-2022-44073 | tribalsystems/zenario | Cross-site Scripting in Zenario | medium | 5.4 | 0% |
| CVE-2023-3372 | lana-shortcodes (WordPress plugin) | The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2026-48015 | shopware/core, shopware/platform | Shopware: Stored XSS via SVG file upload — no SVG sanitization | medium | 4.9 | 0% |
| CVE-2026-55691 | starcitizenwiki/embedvideo | StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template | high | 8.6 | 0% |
| CVE-2023-2014 | microweber/microweber | Microweber vulnerable to cross-site scripting (XSS) | medium | 4.8 | 0% |
| CVE-2024-1712 | carousel-slider (WordPress plugin) | The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.7 | 0% |
| CVE-2023-2999 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to cross-site scripting | medium | 6.7 | 0% |
| CVE-2024-1570 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2021-36905 | quiz-master-next (WordPress plugin) | Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-37297 | woocommerce (WordPress plugin), woocommerce/woocommerce | WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site sc | medium | 5.4 | 0% |
| CVE-2021-24431 | language-bar-flags (WordPress plugin) | The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escap | medium | 4.3 | 0% |
| CVE-2021-24586 | per-page-add-to-head (WordPress plugin) | The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2023-5316 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | critical | 9.1 | 0% |
| CVE-2023-5467 | geo-my-wp (WordPress plugin) | The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 | medium | 6.4 | 0% |
| CVE-2023-5618 | modern-footnotes (WordPress plugin) | The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-13803 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2024-9356 | yotpo-social-reviews-for-woocommerce (WordPress plugin) | The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_ | medium | 6.1 | 0% |
| CVE-2023-1869 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2. | medium | 5.5 | 0% |
| CVE-2023-2436 | blog-in-blog (WordPress plugin) | The Blog-in-Blog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blog_in_blog' shortcode in versions up to, and i | medium | 4.4 | 0% |