Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1172 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 5.4 | 0% |
| CVE-2023-7233 | gigpress (WordPress plugin) | The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2026-35035 | ci4-cms-erp/ci4ms | CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via Syst | critical | 9.1 | 0% |
| CVE-2025-3649 | lightbox (WordPress plugin) | The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with | medium | 6.8 | 0% |
| CVE-2023-5749 | embedpress (WordPress plugin) | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Ref | medium | 6.1 | 0% |
| CVE-2024-10878 | sugar-calendar-lite (WordPress plugin) | The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer | medium | 6.1 | 0% |
| CVE-2023-3245 | chaty (WordPress plugin) | The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2023-5955 | contact-form-email (WordPress plugin) | The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-3751 | seriously-simple-podcasting (WordPress plugin) | The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-4090 | my-sticky-bar (WordPress plugin) | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does no | medium | 4.8 | 0% |
| CVE-2024-9768 | formidable-forms (WordPress plugin) | The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2022-45082 | accordions-or-faqs (WordPress plugin) | Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin <= 2.0.3 on WordPress via &addons-style-name | low | 3.4 | 0% |
| CVE-2023-2757 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' | high | 7.4 | 0% |
| CVE-2024-0239 | contact-form-7-connector (WordPress plugin) | The Contact Form 7 Connector WordPress plugin before 1.2.3 does not sanitise and escape a parameter before outputting it back in the page, l | medium | 6.1 | 0% |
| CVE-2024-8739 | wp-recaptcha-integration (WordPress plugin) | The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg | medium | 6.1 | 0% |
| CVE-2022-42460 | traffic-manager (WordPress plugin) | Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress. | medium | 6.5 | 0% |
| CVE-2024-3554 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-3665 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's HowTo and FAQ widgets | medium | 6.4 | 0% |
| CVE-2024-1246 | concrete5/concrete5 | Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature | low | 2.0 | 0% |
| CVE-2024-2655 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post widgets in all vers | medium | 6.4 | 0% |
| CVE-2024-9225 | wp-seopress (WordPress plugin) | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_que | medium | 6.1 | 0% |
| CVE-2023-5942 | medialist (WordPress plugin) | The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-8499 | woo-checkout-field-editor-pro (WordPress plugin) | The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘r | medium | 4.7 | 0% |
| CVE-2023-5048 | contact-form-builder (WordPress plugin) | The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versi | medium | 6.4 | 0% |
| CVE-2023-6807 | generatepress (WordPress plugin) | The GeneratePress Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom meta output in all versi | medium | 6.4 | 0% |
| CVE-2024-2664 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Widget in all | medium | 6.4 | 0% |
| CVE-2024-2868 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-5260 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-12262 | ebook-store (WordPress plugin) | The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and inc | medium | 6.1 | 0% |
| CVE-2024-9021 | relevanssi (WordPress plugin) | In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS | medium | 5.4 | 0% |
| CVE-2023-5119 | forminator (WordPress plugin) | The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could | medium | 4.8 | 0% |
| CVE-2023-5209 | bookly (WordPress plugin) | The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which cou | medium | 4.8 | 0% |
| CVE-2023-5343 | popup-box (WordPress plugin) | The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2023-5757 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-25737 | vufind/vufind | VuFind Server-Side Request Forgery (SSRF) vulnerability | critical | 9.1 | 0% |
| CVE-2024-6133 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.5 | 0% |
| CVE-2024-10374 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_loginout shortcode | medium | 6.4 | 0% |
| CVE-2024-43407 | ckeditor/ckeditor | Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability | medium | 6.1 | 0% |
| CVE-2023-5809 | popup-box (WordPress plugin) | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2023-5874 | popup-box (WordPress plugin) | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2023-5971 | save-as-pdf (WordPress plugin) | The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high p | medium | 4.8 | 0% |
| CVE-2021-24801 | wp-survey-plus (WordPress plugin) | The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any u | medium | 4.3 | 0% |
| CVE-2023-34023 | wordpress-social-login (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. | high | 7.1 | 0% |
| CVE-2023-6782 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in | medium | 6.4 | 0% |
| CVE-2024-0383 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [wprm-recipe-instructions] and [wprm- | medium | 6.4 | 0% |
| CVE-2024-1073 | wp-slimstat (WordPress plugin) | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-2028 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Covid-19 Stats Widget in all ve | medium | 6.4 | 0% |
| CVE-2024-2129 | wpbits-addons-for-elementor (WordPress plugin) | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widg | medium | 6.4 | 0% |
| CVE-2024-3197 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in the plugin's wi | medium | 6.4 | 0% |
| CVE-2021-24432 | advanced-ajax-product-filters (WordPress plugin) | The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading | medium | 6.1 | 0% |