Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2604 | team-circle-image-slider-with-lightbox (WordPress plugin) | The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parame | medium | 6.1 | 0% |
| CVE-2023-4067 | bus-ticket-booking-with-seat-reservation (WordPress plugin) | The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'ta | medium | 6.1 | 0% |
| CVE-2024-8715 | simple-ldap-login (WordPress plugin) | The Simple LDAP Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria | medium | 6.1 | 0% |
| CVE-2024-8788 | eu-vat-for-woocommerce (WordPress plugin) | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg w | medium | 6.1 | 0% |
| CVE-2024-8872 | order-hours-scheduler-for-woocommerce (WordPress plugin) | The Store Hours for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without | medium | 6.1 | 0% |
| CVE-2024-9378 | yml-for-yandex-market (WordPress plugin) | The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up t | medium | 6.1 | 0% |
| CVE-2024-2296 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file up | medium | 5.5 | 0% |
| CVE-2022-40694 | news-announcement-scroll (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-41315 | ezoic (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-43463 | custom-product-tabs-for-woocommerce (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-44591 | anthologize (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin <= 0.8.0 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-44736 | chameleon (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress. | medium | 4.8 | 0% |
| CVE-2024-5472 | wp-quicklatex (WordPress plugin) | The WP QuickLaTeX WordPress plugin before 3.8.7 does not sanitise and escape some of its settings, which could allow high privilege users su | high | 7.1 | 0% |
| CVE-2024-51494 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php | high | 7.5 | 0% |
| CVE-2024-51495 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php | high | 7.5 | 0% |
| CVE-2023-4889 | shareaholic (WordPress plugin) | The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and includi | medium | 6.4 | 0% |
| CVE-2024-9239 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_qu | medium | 6.1 | 0% |
| CVE-2024-3048 | bannerlid (WordPress plugin) | The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross | medium | 5.5 | 0% |
| CVE-2021-24433 | simple-sort\&search (WordPress plugin) | The simple sort&search WordPress plugin through 0.0.3 does not make sure that the indexurl parameter of the shortcodes "category_sims", "ord | medium | 5.4 | 0% |
| CVE-2024-0719 | tabs-shortcode-and-widget (WordPress plugin) | The Tabs Shortcode and Widget WordPress plugin through 1.17 does not validate and escape some of its shortcode attributes before outputting | medium | 5.4 | 0% |
| CVE-2024-4305 | postx (WordPress plugin) | The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block optio | medium | 6.8 | 0% |
| CVE-2024-5744 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribut | medium | 6.8 | 0% |
| CVE-2023-5076 | ziteboard-online-whiteboard (WordPress plugin) | The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions | medium | 6.4 | 0% |
| CVE-2023-5096 | hk-filter-and-search (WordPress plugin) | The HTML filter and csv-file search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'csvsearch' shortcode | medium | 6.4 | 0% |
| CVE-2023-5507 | imagemapper (WordPress plugin) | The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, | medium | 6.4 | 0% |
| CVE-2023-5567 | qr-code-tag (WordPress plugin) | The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and including | medium | 6.4 | 0% |
| CVE-2023-5742 | easyrotator-for-wordpress (WordPress plugin) | The EasyRotator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyrotator' shortcode in | medium | 6.4 | 0% |
| CVE-2023-6934 | limit-login-attempts-reloaded (WordPress plugin) | The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all ver | medium | 6.4 | 0% |
| CVE-2024-11385 | pure-css-circle-progress-bar (WordPress plugin) | The Pure CSS Circle Progress bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'circle_progress' shortc | medium | 6.4 | 0% |
| CVE-2024-1449 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slide shor | medium | 6.4 | 0% |
| CVE-2024-1697 | add-fields-to-checkout-page-woocommerce (WordPress plugin) | The Custom WooCommerce Checkout Fields Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the save_wcfe_options fu | medium | 6.4 | 0% |
| CVE-2024-2141 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all | medium | 6.4 | 0% |
| CVE-2024-2142 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Info Table widget in | medium | 6.4 | 0% |
| CVE-2024-2144 | ultimate-addons-for-beaver-builder-lite (WordPress plugin) | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widg | medium | 6.4 | 0% |
| CVE-2024-2202 | siteorigin-panels (WordPress plugin) | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions | medium | 6.4 | 0% |
| CVE-2024-2799 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Tex | medium | 6.4 | 0% |
| CVE-2024-3988 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-11376 | s2member (WordPress plugin) | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vu | medium | 6.1 | 0% |
| CVE-2024-4096 | responsive-tabs (WordPress plugin) | The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege u | medium | 5.9 | 0% |
| CVE-2023-6005 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which co | medium | 4.8 | 0% |
| CVE-2023-6046 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 4.8 | 0% |
| CVE-2025-51487 | moonshine/moonshine | moonshine Stored Cross-Site Scripting Vulnerability in Create Article | medium | 4.5 | 0% |
| CVE-2026-44175 | getkirby/cms | Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend | high | 0.0 | 0% |
| CVE-2024-51093 | snipe/snipe-it | Cross Site Scripting vulnerability in Snipe-IT | high | 8.7 | 0% |
| CVE-2026-23997 | facturascripts/facturascripts | FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View | high | 8.0 | 0% |
| CVE-2024-1235 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom class field in all version | medium | 6.4 | 0% |
| CVE-2024-1496 | featured-image-from-url (WordPress plugin) | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all | medium | 6.4 | 0% |
| CVE-2024-2436 | lightweight-accordion (WordPress plugin) | The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 0% |
| CVE-2024-2504 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attr' | medium | 6.4 | 0% |
| CVE-2024-3161 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's attributes in all version | medium | 6.4 | 0% |