Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-41132 | ezoic (WordPress plugin) | Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. | medium | 6.1 | 0% |
| CVE-2023-3933 | your-journey (WordPress theme) | The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and includin | medium | 6.1 | 0% |
| CVE-2023-3962 | winters (WordPress theme) | The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1. | medium | 6.1 | 0% |
| CVE-2023-3965 | nsc (WordPress theme) | The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 du | medium | 6.1 | 0% |
| CVE-2024-47069 | oveleon/contao-cookiebar | Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar | medium | 6.1 | 0% |
| CVE-2025-0864 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scri | medium | 6.1 | 0% |
| CVE-2023-5237 | memberlite-shortcodes (WordPress plugin) | The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2024-3340 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gallery-slideshow' shor | medium | 5.4 | 0% |
| CVE-2022-4973 | WordPress core | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with acce | medium | 4.9 | 0% |
| CVE-2026-42548 | flightphp/core | Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp() | high | 0.0 | 0% |
| CVE-2025-62508 | starcitizentools/citizen-skin | Citizen vulnerable to stored XSS in sticky header button messages | medium | 6.5 | 0% |
| CVE-2024-6021 | donation-block-for-paypal (WordPress plugin) | The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site s | medium | 6.8 | 0% |
| CVE-2024-4655 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2023-1884 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter | medium | 4.7 | 0% |
| CVE-2025-2205 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored C | medium | 4.4 | 0% |
| CVE-2026-40598 | mantisbt/mantisbt | MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page | medium | 0.0 | 0% |
| CVE-2024-45592 | damienharper/auditor-bundle | auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped | high | 8.2 | 0% |
| CVE-2024-0678 | order-delivery-date (WordPress plugin) | The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' para | medium | 6.5 | 0% |
| CVE-2023-6561 | featured-image-from-url (WordPress plugin) | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all | medium | 6.4 | 0% |
| CVE-2024-1276 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-2423 | userswp (WordPress plugin) | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnera | medium | 6.4 | 0% |
| CVE-2024-2623 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2023-4315 | woo-custom-emails (WordPress plugin) | The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to, and | medium | 6.1 | 0% |
| CVE-2024-6487 | inline-related-posts (WordPress plugin) | The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 5.9 | 0% |
| CVE-2024-2369 | coblocks (WordPress plugin) | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting the | medium | 5.4 | 0% |
| CVE-2022-45816 | gd-bbpress-attachments (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress. | medium | 4.8 | 0% |
| CVE-2020-15400 | cakephp/cakephp | Cross-Site Request Forgery in CakePHP | medium | 4.3 | 0% |
| CVE-2023-6961 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and includ | high | 7.2 | 0% |
| CVE-2023-5413 | image-horizontal-reel-scroll-slideshow (WordPress plugin) | The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode i | medium | 6.4 | 0% |
| CVE-2024-1791 | wp-codemirror-block (WordPress plugin) | The CodeMirror Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Code Mirror block in all versions up to, and | medium | 6.4 | 0% |
| CVE-2023-5141 | bsk-contact-form-7-blacklist (WordPress plugin) | The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting | medium | 6.1 | 0% |
| CVE-2023-5641 | free-\&-easy-link-building (WordPress plugin) | The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before ou | medium | 6.1 | 0% |
| CVE-2023-0152 | wp-multi-store-locator (WordPress plugin) | The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2023-0280 | ultimate-carousel-for-elementor (WordPress plugin) | The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting | medium | 5.4 | 0% |
| CVE-2023-0363 | scheduled-announcements-widget (WordPress plugin) | The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputti | medium | 5.4 | 0% |
| CVE-2023-0368 | responsive-tabs-for-wpbakery-page-builder (WordPress plugin) | The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of i | medium | 5.4 | 0% |
| CVE-2023-0369 | gotowp (WordPress plugin) | The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a pag | medium | 5.4 | 0% |
| CVE-2023-0374 | w4-post-list (WordPress plugin) | The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/ | medium | 5.4 | 0% |
| CVE-2023-0538 | campaign-url-builder (WordPress plugin) | The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2023-0542 | custom-post-type-list-shortcode (WordPress plugin) | The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outp | medium | 5.4 | 0% |
| CVE-2023-0891 | stagtools (WordPress plugin) | The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2023-2817 | craftcms/cms | Stored cross site scripting in Craft CMS | medium | 5.4 | 0% |
| CVE-2023-5323 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2026-34463 | mantisbt/mantisbt | MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form | high | 0.0 | 0% |
| CVE-2024-51496 | librenms/librenms | LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php | high | 7.5 | 0% |
| CVE-2023-3167 | mail-queue (WordPress plugin) | The Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.1 | high | 7.2 | 0% |
| CVE-2024-1282 | email-encoder-bundle (WordPress plugin) | The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-8482 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all ve | medium | 6.4 | 0% |
| CVE-2024-8546 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video widget in all vers | medium | 6.4 | 0% |
| CVE-2021-36572 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 6.1 | 0% |