Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-41643 | accessibility (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress. | medium | 4.8 | 0% |
| CVE-2024-37160 | getformwork/formwork | Cross-site scripting (XSS) vulnerability in Description metadata | medium | 4.8 | 0% |
| CVE-2024-56361 | tltneon/lgsl | lgsl Stored Cross-Site Scripting vulnerability | high | 0.0 | 0% |
| CVE-2023-3080 | wp-mail-catcher (WordPress plugin) | The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, | high | 7.2 | 0% |
| CVE-2023-3088 | wp-mail-log (WordPress plugin) | The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 | high | 7.2 | 0% |
| CVE-2023-3093 | yaysmtp (WordPress plugin) | The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due | high | 7.2 | 0% |
| CVE-2023-3122 | gd-mail-queue (WordPress plugin) | The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9 | high | 7.2 | 0% |
| CVE-2023-3135 | mailtree-log-mail (WordPress plugin) | The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and includin | high | 7.2 | 0% |
| CVE-2023-3136 | mailarchiver (WordPress plugin) | The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2. | high | 7.2 | 0% |
| CVE-2023-3166 | lana-email-logger (WordPress plugin) | The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and includin | high | 7.2 | 0% |
| CVE-2023-3168 | wp-reroute-email (WordPress plugin) | The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including | high | 7.2 | 0% |
| CVE-2024-2117 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-6848 | post-and-page-builder (WordPress plugin) | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via fi | medium | 6.4 | 0% |
| CVE-2024-0905 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.3 | 0% |
| CVE-2024-8714 | slicewp (WordPress plugin) | The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of | medium | 6.1 | 0% |
| CVE-2024-9204 | 404page (WordPress plugin) | The Smart Custom 404 Error Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all vers | medium | 6.1 | 0% |
| CVE-2024-0420 | mappress-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashbo | medium | 5.4 | 0% |
| CVE-2024-2786 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, | medium | 5.4 | 0% |
| CVE-2024-10010 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-10222 | svg-support (WordPress plugin) | The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2023-4757 | staff-\/-employee-business-directory-for-active-directory (WordPress plugin) | The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from t | medium | 5.4 | 0% |
| CVE-2022-40963 | wp-pagebuilder (WordPress plugin) | Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress. | medium | 4.8 | 0% |
| CVE-2024-4217 | shortcodes-ultimate (WordPress plugin) | The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for | medium | 4.7 | 0% |
| CVE-2023-6924 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1 | medium | 4.4 | 0% |
| CVE-2026-55790 | craftcms/cms | Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget | high | 0.0 | 0% |
| CVE-2023-2550 | thorsten/phpmyfaq | Cross Site Scripting in thorsten/phpmyfaq | high | 8.2 | 0% |
| CVE-2022-47145 | blockonomics (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions. | high | 7.1 | 0% |
| CVE-2023-7151 | product-enquiry-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in | medium | 6.1 | 0% |
| CVE-2024-47536 | starcitizentools/citizen-skin | starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field | medium | 4.6 | 0% |
| CVE-2026-113712 | cachethq/cachet | Cachet has Stored XSS in Incident Component | medium | 0.0 | 0% |
| CVE-2024-55878 | shuchkin/simplexlsx | Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx | medium | 6.8 | 0% |
| CVE-2024-2665 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button in all versions u | medium | 6.4 | 0% |
| CVE-2023-25453 | wordpress-tables (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ian Sadovy WordPress Tables plugin <= 1.3.9 versions. | high | 7.1 | 0% |
| CVE-2023-1805 | product-catalog-feed (WordPress plugin) | The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it | medium | 6.1 | 0% |
| CVE-2023-3954 | multiparcels-shipping-for-woocommerce (WordPress plugin) | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back | medium | 6.1 | 0% |
| CVE-2023-5211 | fattura24 (WordPress plugin) | The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-1958 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 4.8 | 0% |
| CVE-2015-10127 | pluscaptcha (WordPress plugin) | A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unkno | low | 3.5 | 0% |
| CVE-2024-34067 | pterodactyl/panel | Pterodactyl panel's admin area vulnerable to Cross-site Scripting | medium | 6.1 | 0% |
| CVE-2025-5062 | woocommerce (WordPress plugin) | The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions | medium | 6.1 | 0% |
| CVE-2023-0285 | real-media-library (WordPress plugin) | The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with t | medium | 5.4 | 0% |
| CVE-2023-0371 | embedsocial (WordPress plugin) | The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-0540 | gs-filterable-portfolio (WordPress plugin) | The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2023-1703 | pimcore/pimcore | pimcore is vulnerable to cross-site scripting in Composite indices key field | medium | 5.4 | 0% |
| CVE-2024-0820 | jobs-for-wordpress (WordPress plugin) | The Jobs for WordPress plugin before 2.7.4 does not sanitise and escape some parameters, which could allow users with a role as low as contr | medium | 5.4 | 0% |
| CVE-2023-37785 | impresscms/impresscms | ImpressCMS Cross-site Scripting vulnerability | medium | 4.8 | 0% |
| CVE-2024-9878 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin setti | medium | 4.4 | 0% |
| CVE-2024-34899 | wwbn/avideo | AVideo cross-site scripting vulnerability in the view/about.php page | medium | 6.1 | 0% |
| CVE-2024-4924 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privileg | medium | 6.1 | 0% |
| CVE-2023-5458 | cits-support-svg\,-webp-media-and-ttf\,otf-file-upload (WordPress plugin) | The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow | medium | 5.4 | 0% |