Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-0587 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' paramet | medium | 6.1 | 0% |
| CVE-2024-1331 | team-members (WordPress plugin) | The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 6.1 | 0% |
| CVE-2024-1752 | font-farsi (WordPress plugin) | The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 6.1 | 0% |
| CVE-2024-25876 | enhavo/enhavo-app | Enhavo Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2023-0736 | wallabag/wallabag | Cross-site Scripting (XSS) in wallabag/wallabag | medium | 5.4 | 0% |
| CVE-2024-1500 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Logo Widget in all versio | medium | 5.4 | 0% |
| CVE-2023-6555 | email-subscription-popup (WordPress plugin) | The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 0% |
| CVE-2023-6629 | post-smtp (WordPress plugin) | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Refl | medium | 6.1 | 0% |
| CVE-2024-1273 | starbox (WordPress plugin) | The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contri | medium | 6.1 | 0% |
| CVE-2024-3692 | gutenverse (WordPress plugin) | The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a pa | medium | 6.1 | 0% |
| CVE-2023-34172 | wordpress-social-login (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. | medium | 5.9 | 0% |
| CVE-2024-0561 | ultimate-posts-widget (WordPress plugin) | The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back | medium | 5.4 | 0% |
| CVE-2024-1746 | testimonial-slider-and-showcase (WordPress plugin) | The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 5.4 | 0% |
| CVE-2024-5595 | essential-blocks (WordPress plugin) | The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a | medium | 5.4 | 0% |
| CVE-2023-0844 | namaste\!-lms (WordPress plugin) | The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such | medium | 4.8 | 0% |
| CVE-2023-0893 | time-sheets (WordPress plugin) | The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-1021 | amr-ical-events-list (WordPress plugin) | The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2023-1025 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2023-1121 | simple-giveaways (WordPress plugin) | The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2023-1122 | simple-giveaways (WordPress plugin) | The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privi | medium | 4.8 | 0% |
| CVE-2023-1649 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2023-2254 | ko-fi-button (WordPress plugin) | The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Sto | medium | 4.8 | 0% |
| CVE-2023-5005 | autocomplete-location-field-contact-form-7 (WordPress plugin) | The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin | medium | 4.8 | 0% |
| CVE-2023-5243 | login-screen-manager (WordPress plugin) | The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege | medium | 4.8 | 0% |
| CVE-2024-6130 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2025-1039 | lenix-elementor-leads-addon (WordPress plugin) | The Lenix Elementor Leads addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a URL form field in all versions up to | high | 7.2 | 0% |
| CVE-2024-1349 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for Wor | medium | 6.4 | 0% |
| CVE-2024-4624 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to S | medium | 6.4 | 0% |
| CVE-2022-43320 | feehi/cms | FeehiCMS is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 0% |
| CVE-2024-3548 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it b | medium | 6.1 | 0% |
| CVE-2020-25915 | thinkcmf/thinkcmf | ThinkCMF Cross-site Scripting Vulnerability | medium | 5.4 | 0% |
| CVE-2023-28664 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in | medium | 5.4 | 0% |
| CVE-2023-28666 | inpost-gallery (WordPress plugin) | The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' para | medium | 5.4 | 0% |
| CVE-2024-2666 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Wi | medium | 5.4 | 0% |
| CVE-2024-0902 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-1660 | top-bar (WordPress plugin) | The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-8661 | concrete5/concrete5 | Concrete CMS Stored XSS in the "Next&Previous Nav" block | low | 2.4 | 0% |
| CVE-2024-4749 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, le | high | 8.3 | 0% |
| CVE-2024-3647 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post ticker widget in al | medium | 6.4 | 0% |
| CVE-2024-8663 | wp-simple-booking-calendar (WordPress plugin) | The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove | medium | 6.1 | 0% |
| CVE-2023-2527 | integration-for-contact-form-7-and-zoho-crm\,-bigin (WordPress plugin) | The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter befor | medium | 4.8 | 0% |
| CVE-2023-3170 | tagdiv-composer (WordPress plugin) | The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and | medium | 4.8 | 0% |
| CVE-2023-4829 | froxlor/froxlor | Cross-site Scripting (XSS) in froxlor/froxlor | medium | 4.8 | 0% |
| CVE-2023-5861 | microweber/microweber | Cross-site Scripting (XSS) in microweber/microweber | medium | 4.8 | 0% |
| CVE-2023-7154 | hubbub-lite (WordPress plugin) | The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow h | medium | 4.8 | 0% |
| CVE-2024-6158 | category-posts-widget (WordPress plugin), term-and-category-based-posts-widget (WordPress plugin) | The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not valid | medium | 4.8 | 0% |
| CVE-2026-55466 | snipe/snipe-it | Snipe-IT vulnerable to stored XSS via inline-served attachment | high | 8.7 | 0% |
| CVE-2019-7874 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 6.5 | 0% |
| CVE-2023-4960 | wc-multivendor-marketplace (WordPress plugin) | The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and in | medium | 6.4 | 0% |
| CVE-2024-0792 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode( | medium | 6.4 | 0% |