Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1171 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 5.4 | 0% |
| CVE-2024-13119 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 | medium | 4.8 | 0% |
| CVE-2024-2309 | wp-staging (WordPress plugin) | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and es | medium | 4.8 | 0% |
| CVE-2024-5002 | user-submitted-posts (WordPress plugin) | The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2026-41147 | nukeviet/nukeviet | NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class | high | 8.7 | 0% |
| CVE-2023-4773 | wordpress-social-login (WordPress plugin) | The WordPress Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wordpress_social_login_meta' shortcode | medium | 6.4 | 0% |
| CVE-2022-48614 | mediawiki/semantic-media-wiki | Cross-site Scripting in Semantic MediaWiki | medium | 6.1 | 0% |
| CVE-2024-4061 | survey-maker (WordPress plugin) | The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-1463 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz tit | medium | 4.4 | 0% |
| CVE-2024-1571 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, a | medium | 4.4 | 0% |
| CVE-2024-46209 | redaxo/source | REDAXO CMS Cross-site Scripting vulnerability | low | 0.0 | 0% |
| CVE-2024-29763 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Tax | high | 7.1 | 0% |
| CVE-2023-23708 | visualizer (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin | medium | 6.5 | 0% |
| CVE-2024-1537 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2025-53093 | starcitizentools/tabber-neue | TabberNeue vulnerable to Stored XSS through wikitext | high | 8.6 | 0% |
| CVE-2023-4308 | user-submitted-posts (WordPress plugin) | The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in ver | high | 7.2 | 0% |
| CVE-2024-4370 | wpzoom-elementor-addons (WordPress plugin) | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widg | medium | 6.4 | 0% |
| CVE-2023-4250 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading t | medium | 6.1 | 0% |
| CVE-2023-5238 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an H | medium | 6.1 | 0% |
| CVE-2023-6050 | estatik (WordPress plugin) | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outpu | medium | 6.1 | 0% |
| CVE-2023-6161 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2023-6166 | quiz-maker (WordPress plugin) | The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cro | medium | 6.1 | 0% |
| CVE-2023-6268 | json-content-importer (WordPress plugin) | The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page | medium | 6.1 | 0% |
| CVE-2023-7170 | rsvp-events (WordPress plugin) | The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading t | medium | 6.1 | 0% |
| CVE-2024-2278 | woocommerce-product-filter (WordPress plugin) | Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users suc | medium | 6.1 | 0% |
| CVE-2024-2729 | otter-blocks (WordPress plugin) | The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final | medium | 6.1 | 0% |
| CVE-2024-2870 | swift-framework (WordPress plugin) | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape a parameter before outputting it back in the page | medium | 6.1 | 0% |
| CVE-2023-6067 | user-profile-avatar (WordPress plugin) | The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2024-45932 | krayin/laravel-crm | Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name | medium | 4.8 | 0% |
| CVE-2026-42841 | getgrav/grav | Grav CMS vulnerable to stored XSS via Markdown media attribute() action | medium | 4.8 | 0% |
| CVE-2024-1977 | restaurant-solutions---checklist (WordPress plugin) | The Restaurant Solutions – Checklist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Checklist points in version 1 | medium | 4.4 | 0% |
| CVE-2023-1704 | pimcore/pimcore | pimcore is vulnerable to cross-site scripting in translate module | medium | 0.0 | 0% |
| CVE-2024-1572 | wp-ulike (WordPress plugin) | The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_ulike' shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-3923 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_target parameter | medium | 6.4 | 0% |
| CVE-2024-4107 | website-builder (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2023-0313 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-2342 | pimcore/pimcore | Cross-site Scripting (XSS) in Website Settings name field | medium | 5.4 | 0% |
| CVE-2024-1055 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 5.4 | 0% |
| CVE-2022-40968 | 2kb-amazon-affiliates-store (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress. | medium | 4.8 | 0% |
| CVE-2026-40607 | mantisbt/mantisbt | MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column | high | 0.0 | 0% |
| CVE-2025-24018 | yeswiki/yeswiki | Authenticated Stored XSS in YesWiki | high | 7.6 | 0% |
| CVE-2023-5292 | acf-extended (WordPress plugin) | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in vers | medium | 6.4 | 0% |
| CVE-2024-4618 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member widget in all versi | medium | 6.4 | 0% |
| CVE-2024-8363 | share-this-image (WordPress plugin) | The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shortcode in all version | medium | 6.4 | 0% |
| CVE-2025-5096 | tablepress (WordPress plugin) | The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', | medium | 6.4 | 0% |
| CVE-2023-41661 | smarty (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 version | medium | 5.9 | 0% |
| CVE-2024-45046 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information | medium | 5.4 | 0% |
| CVE-2023-2707 | gappointments (WordPress plugin) | The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2023-5564 | froxlor/froxlor | Cross-site Scripting (XSS) in froxlor/froxlor | medium | 4.8 | 0% |
| CVE-2024-2439 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |