Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5292 | acf-extended (WordPress plugin) | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in vers | medium | 6.4 | 0% |
| CVE-2024-4618 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member widget in all versi | medium | 6.4 | 0% |
| CVE-2024-8363 | share-this-image (WordPress plugin) | The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shortcode in all version | medium | 6.4 | 0% |
| CVE-2025-5096 | tablepress (WordPress plugin) | The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', | medium | 6.4 | 0% |
| CVE-2023-41661 | smarty (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 version | medium | 5.9 | 0% |
| CVE-2024-45046 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information | medium | 5.4 | 0% |
| CVE-2023-2707 | gappointments (WordPress plugin) | The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2023-5564 | froxlor/froxlor | Cross-site Scripting (XSS) in froxlor/froxlor | medium | 4.8 | 0% |
| CVE-2024-2439 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-9898 | parallax-image (WordPress plugin) | The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-1106 | shariff-wrapper (WordPress plugin) | The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 6.1 | 0% |
| CVE-2024-34467 | topthink/framework | ThinkPHP Cross-Site Scripting Vulnerability | medium | 6.1 | 0% |
| CVE-2024-4269 | svg-block (WordPress plugin) | The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG w | medium | 6.1 | 0% |
| CVE-2024-47186 | filament/infolists, filament/tables | Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting | medium | 6.1 | 0% |
| CVE-2024-29376 | sylius/sylius | Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book | medium | 0.0 | 0% |
| CVE-2025-49130 | barryvdh/laravel-translation-manager | Laravel Translation Manager Vulnerable to Stored Cross-site Scripting | medium | 0.0 | 0% |
| CVE-2026-54347 | froxlor/froxlor | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover | high | 8.7 | 0% |
| CVE-2024-12024 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_c | high | 7.2 | 0% |
| CVE-2024-5266 | download-manager (WordPress plugin) | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packa | medium | 6.4 | 0% |
| CVE-2024-9024 | material-design-icons (WordPress plugin) | The Material Design Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mdi-icon shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-45803 | wireui/wireui | Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content | medium | 6.1 | 0% |
| CVE-2024-6076 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 0% |
| CVE-2024-8740 | getresponse (WordPress plugin) | The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with | medium | 6.1 | 0% |
| CVE-2024-9206 | mas-wp-job-manager-company (WordPress plugin) | The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg wi | medium | 6.1 | 0% |
| CVE-2024-9383 | woo-parcel-pro (WordPress plugin) | The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and in | medium | 6.1 | 0% |
| CVE-2023-4514 | mmm-simple-file-list (WordPress plugin) | The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 0% |
| CVE-2024-3239 | postx (WordPress plugin) | The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block optio | medium | 5.4 | 0% |
| CVE-2023-6732 | ultimate-maps (WordPress plugin) | The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-1401 | profile-box-shortcode-and-widget (WordPress plugin) | The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2026-25496 | craftcms/cms | Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields | medium | 0.0 | 0% |
| CVE-2024-1559 | link-library (WordPress plugin) | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in all versions up to, | medium | 6.5 | 0% |
| CVE-2018-5478 | contao/core | Contao Cross-site Scripting vulnerabililty | medium | 6.1 | 0% |
| CVE-2024-3886 | tagdiv-composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions u | medium | 6.1 | 0% |
| CVE-2025-23210 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters | medium | 5.4 | 0% |
| CVE-2023-1312 | pimcore/pimcore | pimcore is vulnerable to cross-site scripting | medium | 4.8 | 0% |
| CVE-2024-3986 | sportspress (WordPress plugin) | The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-49764 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php | high | 7.5 | 0% |
| CVE-2024-50350 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php | high | 7.5 | 0% |
| CVE-2024-56408 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file | high | 7.1 | 0% |
| CVE-2023-25040 | shortcodes-ultimate (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugi | medium | 6.5 | 0% |
| CVE-2024-11829 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-1396 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ para | medium | 6.4 | 0% |
| CVE-2024-9023 | wp-webauthn (WordPress plugin) | The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwa_login_form shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-10517 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 | medium | 4.8 | 0% |
| CVE-2024-10518 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 | medium | 4.8 | 0% |
| CVE-2023-6526 | meta-box (WordPress plugin) | The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta valu | medium | 6.4 | 0% |
| CVE-2023-6809 | beepress (WordPress plugin) | The Custom fields shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf shortcode in all versions | medium | 6.4 | 0% |
| CVE-2023-6880 | visual-composer-website-builder (WordPress plugin) | The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2023-6982 | shortcode-to-display-post-and-user-data (WordPress plugin) | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting v | medium | 6.4 | 0% |
| CVE-2024-1997 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the Me | medium | 6.4 | 0% |