Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3558 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up | medium | 6.4 | 0% |
| CVE-2024-4865 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-9442 | element-ready-lite (WordPress plugin) | The F4 Improvements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2024-0711 | buttons-shortcode-and-widget (WordPress plugin) | The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputti | medium | 6.1 | 0% |
| CVE-2022-40849 | thinkcmf/thinkcmf | ThinkCMF Stored Cross-Site Scripting (XSS) | medium | 5.4 | 0% |
| CVE-2023-0695 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped | medium | 5.4 | 0% |
| CVE-2023-6556 | woocommerce-currency-switcher (WordPress plugin) | The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via currency opti | medium | 5.4 | 0% |
| CVE-2022-35950 | oro/commerce | OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item | medium | 4.8 | 0% |
| CVE-2023-38474 | campaign-monitor (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Campaign Monitor Campaign Monitor for | high | 7.1 | 0% |
| CVE-2023-46086 | affiliate-toolkit (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SERVIT Software Solutions affiliate-to | high | 7.1 | 0% |
| CVE-2023-48322 | employee-job-application (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Ap | high | 7.1 | 0% |
| CVE-2024-1679 | a4-barcode-generator (WordPress plugin) | The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2021-24349 | gallery-from-files (WordPress plugin) | This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not prop | medium | 6.1 | 0% |
| CVE-2021-24410 | telugu-bible-verse-daily (WordPress plugin) | The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or | medium | 6.1 | 0% |
| CVE-2021-24411 | social-tape (WordPress plugin) | The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them | medium | 6.1 | 0% |
| CVE-2021-24434 | glass (WordPress plugin) | The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Sto | medium | 6.1 | 0% |
| CVE-2021-24466 | verse-o-matic (WordPress plugin) | The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators | medium | 6.1 | 0% |
| CVE-2021-24477 | migrate-users (WordPress plugin) | The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a | medium | 6.1 | 0% |
| CVE-2021-24535 | light-messages (WordPress plugin) | The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content | medium | 6.1 | 0% |
| CVE-2021-24536 | custom-login-redirect (WordPress plugin) | The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or | medium | 6.1 | 0% |
| CVE-2021-24543 | jquery-reply-to-comment (WordPress plugin) | The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its | medium | 6.1 | 0% |
| CVE-2023-5210 | amp-plus (WordPress plugin) | The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 6.1 | 0% |
| CVE-2024-8732 | leira-roles (WordPress plugin) | The Roles & Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without approp | medium | 6.1 | 0% |
| CVE-2021-24683 | weather-effect (WordPress plugin) | The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or esc | medium | 5.4 | 0% |
| CVE-2024-13585 | ajax-search (WordPress plugin) | The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege use | low | 3.5 | 0% |
| CVE-2026-86197 | getgrav/grav | Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super | medium | 0.0 | 0% |
| CVE-2024-4615 | elespare (WordPress plugin) | The Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: | medium | 6.4 | 0% |
| CVE-2024-8681 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Grid widget in all | medium | 6.4 | 0% |
| CVE-2024-8991 | osm (WordPress plugin) | The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's osm_map and osm_map_v3 shortcodes | medium | 6.4 | 0% |
| CVE-2025-24428 | magento/community-edition, magento/project-community-edition | Magento stored Cross-Site Scripting (XSS) vulnerability | medium | 5.4 | 0% |
| CVE-2024-47528 | librenms/librenms | LibreNMS vulnerable to Stored Cross-site Scripting via File Upload | medium | 4.8 | 0% |
| CVE-2025-60880 | bagisto/bagisto | Bagisto is vulnerable to XSS through Admin Panel's product creation path | high | 8.3 | 0% |
| CVE-2023-5125 | formget-contact-form (WordPress plugin) | The Contact Form by FormGet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formget' shortcode in versions up to, and | medium | 6.4 | 0% |
| CVE-2023-5232 | font-awesome-more-icons (WordPress plugin) | The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and in | medium | 6.4 | 0% |
| CVE-2023-5233 | font-awesome-integration (WordPress plugin) | The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, a | medium | 6.4 | 0% |
| CVE-2024-4666 | borderless (WordPress plugin) | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site | medium | 6.4 | 0% |
| CVE-2024-8657 | garden-gnome-package (WordPress plugin) | The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ggpkg shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-9851 | tour-operator (WordPress plugin) | The LSX Tour Operator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-47847 | mediawiki/cargo | Mediawiki Cargo extension vulnerable to Cross-site Scripting | medium | 6.1 | 0% |
| CVE-2024-9777 | ashe (WordPress theme) | The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on | medium | 6.1 | 0% |
| CVE-2023-44383 | october/system | October CMS stored XSS by authenticated backend user with improper configuration | medium | 5.4 | 0% |
| CVE-2023-47839 | ecommerce-product-catalog (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Pl | medium | 6.5 | 0% |
| CVE-2025-49579 | starcitizentools/citizen-skin | starcitizentools/citizen-skin allows stored XSS in menu heading message | medium | 6.5 | 0% |
| CVE-2025-24530 | phpmyadmin/phpmyadmin | phpMyAdmin XSS when checking tables | medium | 6.4 | 0% |
| CVE-2024-2325 | link-library (WordPress plugin) | The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all versions up to, and | medium | 6.1 | 0% |
| CVE-2024-6843 | chatbot-with-chatgpt (WordPress plugin) | The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to | medium | 6.1 | 0% |
| CVE-2024-3189 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu | medium | 5.4 | 0% |
| CVE-2024-4616 | widget-bundle (WordPress plugin) | The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-4857 | fs-product-inquiry (WordPress plugin) | The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape some form submissions, which could allow unauthenticated | medium | 6.1 | 0% |
| CVE-2023-5605 | url-shortify (WordPress plugin) | The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |