Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1058 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the onclick parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-10785 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-1445 | page-scroll-to-id (WordPress plugin) | The Page scroll to id plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-2475 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up | medium | 6.4 | 0% |
| CVE-2024-3974 | buddypress (WordPress plugin) | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and includ | medium | 6.4 | 0% |
| CVE-2022-41788 | soledad (WordPress plugin) | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress. | medium | 5.4 | 0% |
| CVE-2023-0566 | froxlor/froxlor | Froxlor contains Static Code Injection | medium | 4.8 | 0% |
| CVE-2023-1701 | pimcore/pimcore | Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings | medium | 0.0 | 0% |
| CVE-2023-1702 | pimcore/pimcore | Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings | medium | 0.0 | 0% |
| CVE-2024-49759 | librenms/librenms | Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php | high | 7.5 | 0% |
| CVE-2024-7092 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-3188 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes b | medium | 6.3 | 0% |
| CVE-2024-8792 | subscribe-to-comments (WordPress plugin) | The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appro | medium | 6.1 | 0% |
| CVE-2024-0895 | 3d-flipbook-dflip-lite (WordPress plugin) | The PDF Flipbook, 3D Flipbook – DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versi | medium | 5.4 | 0% |
| CVE-2024-7133 | my-sticky-bar (WordPress plugin) | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does no | medium | 4.8 | 0% |
| CVE-2024-7394 | concrete5/concrete5 | Concrete CMS Stored XSS in getAttributeSetName | low | 2.0 | 0% |
| CVE-2023-4962 | video-popup (WordPress plugin) | The Video PopUp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'video_popup' shortcode in versions up to, and includi | medium | 6.4 | 0% |
| CVE-2023-6684 | ibtana-visual-editor (WordPress plugin) | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ive' shortcode in versions | medium | 6.4 | 0% |
| CVE-2023-6994 | list-category-posts (WordPress plugin) | The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-7100 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_button shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-8519 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 6.4 | 0% |
| CVE-2024-9377 | export-woocommerce (WordPress plugin) | The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use o | medium | 6.1 | 0% |
| CVE-2024-9170 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcj_product_meta shortcode in | medium | 5.5 | 0% |
| CVE-2023-4810 | responsive-pricing-table (WordPress plugin) | The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-34349 | sylius/sylius | Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel | medium | 4.8 | 0% |
| CVE-2024-8541 | woo-discount-rules (WordPress plugin) | The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulne | medium | 4.7 | 0% |
| CVE-2024-6011 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in al | medium | 4.4 | 0% |
| CVE-2024-51497 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php | high | 7.5 | 0% |
| CVE-2024-13501 | formassembly-web-forms (WordPress plugin) | The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-2348 | gum-elementor-addon (WordPress plugin) | The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, an | medium | 6.4 | 0% |
| CVE-2024-2460 | gamipress-button (WordPress plugin) | The GamiPress – Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gamipress_button' shortcode in al | medium | 6.4 | 0% |
| CVE-2022-45375 | ifeature-slider (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-5575 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users | medium | 4.7 | 0% |
| CVE-2024-6879 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a | medium | 4.7 | 0% |
| CVE-2024-3628 | easyevent (WordPress plugin) | The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such | low | 3.8 | 0% |
| CVE-2024-1428 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter G | medium | 6.4 | 0% |
| CVE-2024-1507 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tags' attribute of | medium | 6.4 | 0% |
| CVE-2024-2503 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid Widget in all version | medium | 6.4 | 0% |
| CVE-2024-5189 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-9682 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder wid | medium | 6.4 | 0% |
| CVE-2024-9221 | tainacan (WordPress plugin) | The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi | medium | 6.1 | 0% |
| CVE-2024-0903 | userfeedback-lite (WordPress plugin) | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross- | medium | 5.4 | 0% |
| CVE-2023-1081 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 4.8 | 0% |
| CVE-2021-31693 | photo-gallery (WordPress plugin) | The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_fronte | medium | 6.1 | 0% |
| CVE-2022-40209 | wp-smart-import (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress. | medium | 6.1 | 0% |
| CVE-2022-45848 | contest-gallery (WordPress plugin) | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress. | medium | 6.1 | 0% |
| CVE-2023-1978 | shiftcontroller (WordPress plugin) | The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in v | medium | 6.1 | 0% |
| CVE-2023-2184 | responsive-horizontal-vertical-and-accordion-tabs (WordPress plugin) | The WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the s | medium | 6.1 | 0% |
| CVE-2023-2289 | wp-vertical-image-slider (WordPress plugin) | The wordpress vertical image slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in | medium | 6.1 | 0% |
| CVE-2023-2402 | wp-responsive-photo-gallery (WordPress plugin) | The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term | medium | 6.1 | 0% |