Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-45363 | betheme (WordPress plugin) | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress. | medium | 5.4 | 0% |
| CVE-2023-5137 | simply-excerpts (WordPress plugin) | The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-pri | medium | 4.8 | 0% |
| CVE-2024-2444 | inline-related-posts (WordPress plugin) | The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-10568 | ajax-search (WordPress plugin) | The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.7 | 0% |
| CVE-2024-3338 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up t | medium | 4.4 | 0% |
| CVE-2026-40596 | mantisbt/mantisbt | MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference | high | 0.0 | 0% |
| CVE-2023-6806 | starbox (WordPress plugin) | The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to | medium | 6.4 | 0% |
| CVE-2023-6986 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for Wor | medium | 6.4 | 0% |
| CVE-2023-7044 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-0954 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-1411 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of the Twitter Buttons | medium | 6.4 | 0% |
| CVE-2024-1413 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer widget in all v | medium | 6.4 | 0% |
| CVE-2024-1414 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in all ve | medium | 6.4 | 0% |
| CVE-2024-1424 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sho | medium | 6.4 | 0% |
| CVE-2024-1458 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘text_alignment’ attribute of the | medium | 6.4 | 0% |
| CVE-2024-1461 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Team Mem | medium | 6.4 | 0% |
| CVE-2024-1464 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Posts Sl | medium | 6.4 | 0% |
| CVE-2024-1465 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘carousel_skin’ attribute of the | medium | 6.4 | 0% |
| CVE-2024-1466 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_style’ attribute of the P | medium | 6.4 | 0% |
| CVE-2024-1680 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Settings URL of the Banner, | medium | 6.4 | 0% |
| CVE-2024-1854 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2024-2000 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi Sc | medium | 6.4 | 0% |
| CVE-2024-2027 | real-media-library-lite (WordPress plugin) | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style | medium | 6.4 | 0% |
| CVE-2024-2126 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Registration Form widget in all version | medium | 6.4 | 0% |
| CVE-2024-2138 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions u | medium | 6.4 | 0% |
| CVE-2024-2165 | wp-seopress (WordPress plugin) | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-2181 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions | medium | 6.4 | 0% |
| CVE-2024-2183 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions | medium | 6.4 | 0% |
| CVE-2024-2185 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versio | medium | 6.4 | 0% |
| CVE-2024-2186 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Members widget in all ver | medium | 6.4 | 0% |
| CVE-2024-2187 | wpzoom-addons-for-beaver-builder (WordPress plugin) | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all ver | medium | 6.4 | 0% |
| CVE-2024-2237 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-2238 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions | medium | 6.4 | 0% |
| CVE-2024-2239 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions | medium | 6.4 | 0% |
| CVE-2024-2286 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart) plugin for | medium | 6.4 | 0% |
| CVE-2024-3308 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget's at | medium | 6.4 | 0% |
| CVE-2024-3337 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_breadcrumb_element' sho | medium | 6.4 | 0% |
| CVE-2024-3650 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver | medium | 6.4 | 0% |
| CVE-2024-3725 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-3747 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versio | medium | 6.4 | 0% |
| CVE-2024-3885 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subcontainer value parameter in a | medium | 6.4 | 0% |
| CVE-2024-3891 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in widgets in all versions up | medium | 6.4 | 0% |
| CVE-2024-3985 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Call to Action widget | medium | 6.4 | 0% |
| CVE-2024-3991 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-4092 | slider-revolution (WordPress plugin) | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmltag’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-9059 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all | medium | 6.4 | 0% |
| CVE-2024-9668 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget | medium | 6.4 | 0% |
| CVE-2025-24027 | prestashop/ps_contactinfo | ps_contactinfo has a potential XSS due to usage of the nofilter tag in template | medium | 6.2 | 0% |
| CVE-2023-6738 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagel | medium | 5.4 | 0% |
| CVE-2024-0823 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' url in carousels in a | medium | 5.4 | 0% |