Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0145 | world-clock (WordPress plugin) | The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2023-0165 | cost-calculator (WordPress plugin) | The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2023-0172 | juicer (WordPress plugin) | The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/ | medium | 5.4 | 0% |
| CVE-2023-0212 | advanced-recent-posts (WordPress plugin) | The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2023-0364 | real.kit (WordPress plugin) | The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a pa | medium | 5.4 | 0% |
| CVE-2023-0365 | react-webcam (WordPress plugin) | The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-0370 | wpb-advanced-faq (WordPress plugin) | The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 0% |
| CVE-2024-3710 | image-photo-gallery-final-tiles-grid (WordPress plugin) | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before | medium | 6.8 | 0% |
| CVE-2024-1448 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode( | medium | 6.4 | 0% |
| CVE-2023-44379 | baserproject/basercms | baserCMS Cross-site Scripting vulnerability in Site search Feature | medium | 6.1 | 0% |
| CVE-2024-1905 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 5.9 | 0% |
| CVE-2023-1554 | quick-paypal-payments (WordPress plugin) | The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2023-3721 | wp-email (WordPress plugin) | The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-3138 | francoisjacquet/rosariosis | RosarioSIS cross site scripting vulnerability | low | 3.5 | 0% |
| CVE-2024-1236 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-1510 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip | medium | 6.4 | 0% |
| CVE-2024-2042 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver | medium | 6.4 | 0% |
| CVE-2024-13736 | pure-chat (WordPress plugin) | The Pure Chat – Live Chat & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘purechatWidgetName’ parameter i | medium | 6.1 | 0% |
| CVE-2024-9231 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg withou | medium | 6.1 | 0% |
| CVE-2023-6488 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button | medium | 5.4 | 0% |
| CVE-2024-4360 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-4891 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2022-23499 | typo3/cms, typo3/html-sanitizer, typo3/cms-core | TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2017-20061 | elefant/cms | Cross site scripting in Elefant CMS | medium | 5.4 | 0% |
| CVE-2024-0673 | pz-linkcard (WordPress plugin) | The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 6.1 | 0% |
| CVE-2024-5561 | popup-maker (WordPress plugin) | The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-6393 | nextgen-gallery (WordPress plugin) | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which co | medium | 4.8 | 0% |
| CVE-2024-7056 | wpforms (WordPress plugin) | The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such | low | 3.5 | 0% |
| CVE-2023-5565 | shortcode-menu (WordPress plugin) | The Shortcode Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortmenu' shortcode in versions up to, and includ | medium | 6.4 | 0% |
| CVE-2024-13227 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2024-3210 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2023-7015 | file-manager-pro (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and | medium | 6.1 | 0% |
| CVE-2024-1365 | yml-for-yandex-market (WordPress plugin) | The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the feed_id parameter in all versions up | medium | 6.1 | 0% |
| CVE-2024-1691 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO plugin for WordPress is vulnerable to Stored Cross-Site Scr | medium | 6.1 | 0% |
| CVE-2024-8716 | xt-woo-ajax-add-to-cart (WordPress plugin) | The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg | medium | 6.1 | 0% |
| CVE-2022-4022 | svg-support (WordPress plugin) | The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are n | medium | 6.4 | 0% |
| CVE-2024-2603 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege | medium | 6.3 | 0% |
| CVE-2020-15249 | october/backend | Stored XSS by authenticated backend user with access to upload files | low | 2.8 | 0% |
| CVE-2022-4541 | nm-visitors (WordPress plugin) | The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, | high | 7.2 | 0% |
| CVE-2024-7301 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and | high | 7.2 | 0% |
| CVE-2022-40698 | quiz-and-survey-master (WordPress plugin) | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 5.4 | 0% |
| CVE-2023-43884 | intelliants/subrion | Subrion CMS Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-6889 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-6890 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2024-2102 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' param | medium | 4.7 | 0% |
| CVE-2015-10128 | royal-prettyphoto (WordPress plugin) | A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the funct | low | 3.5 | 0% |
| CVE-2023-5661 | add-facebook (WordPress plugin) | The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-0506 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $ | medium | 6.4 | 0% |
| CVE-2024-1277 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up to, and including, 2. | medium | 6.4 | 0% |
| CVE-2024-8515 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like 'TF E Slider | medium | 6.4 | 0% |