Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-4271 | photospace-responsive (WordPress plugin) | The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in version | medium | 4.4 | 0% |
| CVE-2023-5621 | wp-responsive-slider-with-lightbox (WordPress plugin) | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions u | medium | 4.4 | 0% |
| CVE-2023-5819 | amazonify (WordPress plugin) | The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8 | medium | 4.4 | 0% |
| CVE-2024-33670 | passbolt/passbolt_api | Passbolt API allows HTML injection | medium | 4.3 | 0% |
| CVE-2023-6225 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta sh | medium | 6.4 | 0% |
| CVE-2024-0442 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via element URL parameters in all | medium | 6.4 | 0% |
| CVE-2023-0043 | add-user (WordPress plugin) | The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 0% |
| CVE-2024-47526 | librenms/librenms | LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Templates" feature | low | 3.5 | 0% |
| CVE-2020-36703 | website-builder (WordPress plugin) | The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and | medium | 6.4 | 0% |
| CVE-2024-0873 | watu-quiz (WordPress plugin) | The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode in all version | medium | 6.4 | 0% |
| CVE-2024-4003 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-1484 | ameliabooking (WordPress plugin) | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date | medium | 6.1 | 0% |
| CVE-2024-8850 | mailchimp-for-wp (WordPress plugin) | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a pla | medium | 6.1 | 0% |
| CVE-2024-4203 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions u | medium | 5.4 | 0% |
| CVE-2023-6591 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-2159 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting th | medium | 4.7 | 0% |
| CVE-2023-3109 | admidio/admidio | Admidio vulnerable to Cross-site Scripting | medium | 6.3 | 0% |
| CVE-2024-12468 | wp-datepicker (WordPress plugin) | The WP Datepicker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpdp_get_selected_datepicker' parameter in a | medium | 6.1 | 0% |
| CVE-2023-2340 | pimcore/pimcore | Cross-site Scripting (XSS) in DataObject columns grid | medium | 5.4 | 0% |
| CVE-2023-2361 | pimcore/pimcore | Cross-site Scripting (XSS) in pimcore | medium | 5.4 | 0% |
| CVE-2023-2730 | pimcore/pimcore | Pimcore Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-6600 | host-webfonts-local (WordPress plugin) | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stor | high | 8.6 | 0% |
| CVE-2024-4856 | fs-product-inquiry (WordPress plugin) | The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leadin | high | 8.2 | 0% |
| CVE-2024-5429 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attri | high | 7.6 | 0% |
| CVE-2022-4712 | wp-cerber (WordPress plugin) | The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site i | high | 7.2 | 0% |
| CVE-2024-1397 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all | medium | 6.4 | 0% |
| CVE-2024-7247 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-45123 | magento/community-edition | Magento Open Source reflected Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 0% |
| CVE-2022-4466 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputtin | medium | 5.4 | 0% |
| CVE-2024-3963 | rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.14 does not sanitise and escape some parameters, which could allow u | medium | 6.5 | 0% |
| CVE-2022-4656 | visitor-statistics (WordPress plugin) | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, whic | medium | 5.4 | 0% |
| CVE-2023-0144 | event-manager-and-tickets-selling-for-woocommerce (WordPress plugin) | The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post met | medium | 5.4 | 0% |
| CVE-2023-0151 | utubevideo-gallery (WordPress plugin) | The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2023-5319 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | high | 8.3 | 0% |
| CVE-2023-1155 | nd-projects (WordPress plugin) | The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in vers | medium | 6.4 | 0% |
| CVE-2023-3051 | page-builder-by-azexo (WordPress plugin) | The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azh_post' shortcode in versions up to, and | medium | 6.4 | 0% |
| CVE-2024-0963 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode | medium | 6.4 | 0% |
| CVE-2023-1885 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via category field name parameter | medium | 6.3 | 0% |
| CVE-2023-0769 | migration-simple (WordPress plugin) | The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 0% |
| CVE-2024-3964 | product-enquiry-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high | medium | 5.9 | 0% |
| CVE-2022-4393 | imagelinks (WordPress plugin) | The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could a | medium | 5.4 | 0% |
| CVE-2023-1761 | thorsten/phpmyfaq | phpMyFAQ Code Injection vulnerability | medium | 5.4 | 0% |
| CVE-2023-1875 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | 0% |
| CVE-2022-2885 | yetiforce/yetiforce-crm | Cross site scripting in yetiforce/yetiforce-crm | medium | 4.8 | 0% |
| CVE-2024-3489 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Countdown Expired Title in a | medium | 6.4 | 0% |
| CVE-2024-0251 | advanced-woo-search (WordPress plugin) | The Advanced Woo Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search parameter in all versions up to, | medium | 6.1 | 0% |
| CVE-2024-10880 | jobboardwp (WordPress plugin) | The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of a | medium | 6.1 | 0% |
| CVE-2024-5729 | simple-al-slider (WordPress plugin) | The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 0% |
| CVE-2023-2103 | alextselegidis/easyappointments | alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2024-5728 | animated-al-list (WordPress plugin) | The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 5.4 | 0% |