Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4330 | wp-attachments (WordPress plugin) | The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2023-1879 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via updatecategory parameter | medium | 4.7 | 0% |
| CVE-2025-2123 | geshi/geshi | GeSHi XSS possible in the get_var function of /contrib/cssgen.php | low | 3.5 | 0% |
| CVE-2025-8573 | concrete5/concrete5 | Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page | low | 0.0 | 0% |
| CVE-2026-47345 | typo3/html-sanitizer | TYPO3 HTML Sanitizer allows Cross-site Scripting | medium | 0.0 | 0% |
| CVE-2024-1409 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2024-6170 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2023-2427 | thorsten/phpmyfaq | Cross Site Scripting in thorsten/phpmyfaq | medium | 6.1 | 0% |
| CVE-2024-34500 | samwilson/unlinked-wikibase | MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2022-2839 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing | medium | 5.4 | 0% |
| CVE-2023-0389 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high pr | medium | 4.8 | 0% |
| CVE-2023-1759 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 4.8 | 0% |
| CVE-2023-3647 | iurny (WordPress plugin) | The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2023-4858 | simple-table-manager (WordPress plugin) | The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-0662 | fancybox-for-wordpress (WordPress plugin) | The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 d | medium | 4.4 | 0% |
| CVE-2024-12581 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adm | medium | 4.4 | 0% |
| CVE-2023-46627 | wordpress-simple-html-sitemap (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions. | high | 7.1 | 0% |
| CVE-2025-2055 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which cou | medium | 6.8 | 0% |
| CVE-2022-2777 | microweber/microweber | Microweber's title parameter in the body of POST request vulnerable to stored XSS | medium | 6.6 | 0% |
| CVE-2024-3637 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its setting | medium | 6.1 | 0% |
| CVE-2023-0323 | pimcore/pimcore | pimcore is vulnerable to cross-site scripting via "title field " in data objects | medium | 5.4 | 0% |
| CVE-2023-2354 | chp-ads-block-detector (WordPress plugin) | The CHP Ads Block Detector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings reachable though an AJAX act | medium | 4.9 | 0% |
| CVE-2023-2470 | add-to-feedly (WordPress plugin) | The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to | medium | 4.8 | 0% |
| CVE-2023-1756 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export | medium | 4.7 | 0% |
| CVE-2025-48883 | chrome-php/chrome | Chrome PHP is missing encoding in `CssSelector` | medium | 0.0 | 0% |
| CVE-2023-4196 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.3 | 0% |
| CVE-2021-4116 | yetiforce/yetiforce-crm | yetiforcecrm is vulnerable to Cross-site Scripting | medium | 6.6 | 0% |
| CVE-2024-2122 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom UR | medium | 6.4 | 0% |
| CVE-2023-5325 | woocommerce-vietnam-checkout (WordPress plugin) | The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading | medium | 6.1 | 0% |
| CVE-2023-5750 | embedpress (WordPress plugin) | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a spe | medium | 6.1 | 0% |
| CVE-2023-5951 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 0% |
| CVE-2024-0665 | customer-area (WordPress plugin) | The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and | medium | 6.1 | 0% |
| CVE-2024-8662 | koko-analytics (WordPress plugin) | The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-8738 | seriously-simple-stats (WordPress plugin) | The Seriously Simple Stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appr | medium | 6.1 | 0% |
| CVE-2021-36788 | yoast-seo-for-typo3/yoast_seo | Cross-site Scripting in the yoast_seo TYPO3 extension | medium | 5.4 | 0% |
| CVE-2022-4627 | shiftnav (WordPress plugin) | The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the | medium | 5.4 | 0% |
| CVE-2022-4661 | widgets-for-woocommerce-products-on-elementor (WordPress plugin) | The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attribute | medium | 5.4 | 0% |
| CVE-2022-4749 | posts-list-designer (WordPress plugin) | The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputt | medium | 5.4 | 0% |
| CVE-2022-4752 | opening-hours (WordPress plugin) | The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2022-4754 | easy-social-box (WordPress plugin) | The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before output | medium | 5.4 | 0% |
| CVE-2022-4777 | bootstrap-shortcodes (WordPress plugin) | The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2022-4784 | hueman-addons (WordPress plugin) | The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2022-4786 | video.js (WordPress plugin) | The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2023-0063 | wordpress-shortcodes (WordPress plugin) | The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting the | medium | 5.4 | 0% |
| CVE-2023-0064 | evision-responsive-column-layout-shortcodes (WordPress plugin) | The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes b | medium | 5.4 | 0% |
| CVE-2023-0065 | i2-pros-\&-cons (WordPress plugin) | The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2023-0067 | timed-content (WordPress plugin) | The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-0068 | product-gtin-\(ean\,-upc\,-isbn\)-for-woocommerce (WordPress plugin) | The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attribut | medium | 5.4 | 0% |
| CVE-2023-0073 | client-logo-carousel (WordPress plugin) | The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2023-0097 | smart-post-show (WordPress plugin) | The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options be | medium | 5.4 | 0% |