Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3680 | enteraddons (WordPress plugin) | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animati | medium | 6.4 | 0% |
| CVE-2024-3831 | enteraddons (WordPress plugin) | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading | medium | 6.4 | 0% |
| CVE-2024-4209 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-4335 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textAlign’ parameter in | medium | 6.4 | 0% |
| CVE-2024-4383 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_li | medium | 6.4 | 0% |
| CVE-2024-4487 | blocksy-companion (WordPress plugin) | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2. | medium | 6.4 | 0% |
| CVE-2023-49146 | rhukster/dom-sanitizer | Cross-site Scripting in DOMSanitizer | medium | 6.1 | 0% |
| CVE-2024-8968 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow hi | medium | 4.7 | 0% |
| CVE-2020-36769 | widget-settings-importer\/exporter (WordPress plugin) | The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_datap | high | 7.4 | 0% |
| CVE-2024-1596 | ninja-forms-file-uploads (WordPress plugin) | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all | high | 7.2 | 0% |
| CVE-2024-1447 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all v | medium | 6.4 | 0% |
| CVE-2024-3990 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widg | medium | 6.4 | 0% |
| CVE-2023-6525 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar element attributes i | medium | 5.5 | 0% |
| CVE-2024-56199 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ Vulnerable to Stored HTML Injection at FAQ | medium | 5.2 | 0% |
| CVE-2023-1286 | pimcore/pimcore | Cross-site Scripting (XSS) in pimcore/pimcore | medium | 4.8 | 0% |
| CVE-2024-10562 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege | low | 2.7 | 0% |
| CVE-2024-2509 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputti | medium | 6.5 | 0% |
| CVE-2024-11184 | mwdelaney/wp-enable-svg, wp-enable-svg (WordPress plugin) | The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded | medium | 4.8 | 0% |
| CVE-2024-50351 | librenms/librenms | LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php | high | 7.5 | 0% |
| CVE-2024-29777 | forminator (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress P | high | 7.1 | 0% |
| CVE-2025-49578 | starcitizentools/citizen-skin | starcitizentools/citizen-skin allows stored XSS in user registration date message | medium | 6.5 | 0% |
| CVE-2023-5432 | jquery-news-ticker (WordPress plugin) | The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up t | medium | 6.4 | 0% |
| CVE-2024-3266 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up | medium | 6.4 | 0% |
| CVE-2023-7200 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | medium | 6.1 | 0% |
| CVE-2023-5620 | web-push-notifications (WordPress plugin) | The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, so | medium | 5.4 | 0% |
| CVE-2023-5738 | backup-and-migration (WordPress plugin) | The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a | medium | 5.4 | 0% |
| CVE-2024-37308 | cooked (WordPress plugin) | The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` par | medium | 5.4 | 0% |
| CVE-2024-4149 | floating-chat-widget (WordPress plugin) | The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin bef | medium | 4.8 | 0% |
| CVE-2026-44212 | prestashop/prestashop | PrestaShop has a stored XSS executable in customer service view | critical | 9.3 | 0% |
| CVE-2026-63135 | yourls/yourls | YOURLS has stored XSS in referrer statistics chart via crafted Referer header | high | 8.2 | 0% |
| CVE-2025-49575 | starcitizentools/citizen-skin | Citizen skin vulnerable to stored XSS through multiple system messages | medium | 6.5 | 0% |
| CVE-2025-49576 | starcitizentools/citizen-skin | starcitizentools/citizen-skin allows stored XSS in search no result messages | medium | 6.5 | 0% |
| CVE-2025-49577 | starcitizentools/citizen-skin | starcitizentools/citizen-skin allows stored XSS in preference menu heading messages | medium | 6.5 | 0% |
| CVE-2024-2926 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions | medium | 6.4 | 0% |
| CVE-2024-4212 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TF Group Image, TF Na | medium | 6.4 | 0% |
| CVE-2024-8117 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘selected_opti | medium | 6.1 | 0% |
| CVE-2024-8119 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter | medium | 6.1 | 0% |
| CVE-2024-8802 | clio-grow-form (WordPress plugin) | The Clio Grow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escap | medium | 6.1 | 0% |
| CVE-2024-9349 | amazon-auto-links (WordPress plugin) | The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the u | medium | 6.1 | 0% |
| CVE-2024-9667 | seriously-simple-podcasting (WordPress plugin) | The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without | medium | 6.1 | 0% |
| CVE-2024-1274 | my-calendar (WordPress plugin) | The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as S | medium | 5.4 | 0% |
| CVE-2024-3752 | crelly-slider (WordPress plugin) | The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 5.4 | 0% |
| CVE-2024-3755 | mf-gig-calendar (WordPress plugin) | The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 5.4 | 0% |
| CVE-2024-4602 | embed-peertube-playlist (WordPress plugin) | The Embed Peertube Playlist WordPress plugin before 1.10 does not sanitise and escape some of its settings, which could allow high privilege | medium | 5.4 | 0% |
| CVE-2025-23201 | librenms/librenms | Librenms has a reflected XSS on error alert | medium | 5.4 | 0% |
| CVE-2023-5940 | wp-not-login-hide (WordPress plugin) | The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-6256 | feeds-for-youtube (WordPress plugin) | The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2023-26091 | frappant/frp-form-answers | frp_form_answers allows Cross-site Scripting | medium | 6.1 | 0% |
| CVE-2024-23173 | mediawiki/cargo | MediaWiki Cargo Extension Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2024-25875 | enhavo/enhavo-app | Enhavo Cross-site Scripting vulnerability | medium | 6.1 | 0% |