Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-11895 | paypal-payment-button-by-vcita (WordPress plugin) | The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin | medium | 6.4 | 0% |
| CVE-2024-7082 | easy-table-of-contents (WordPress plugin) | The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role | medium | 6.1 | 0% |
| CVE-2024-8656 | wpcodefactory-helper (WordPress plugin) | The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriat | medium | 6.1 | 0% |
| CVE-2024-0897 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in | medium | 6.4 | 0% |
| CVE-2024-1080 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via the heading tag in | medium | 6.4 | 0% |
| CVE-2024-1242 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all v | medium | 6.4 | 0% |
| CVE-2024-2539 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget '_id' attributes in all versio | medium | 6.4 | 0% |
| CVE-2024-5215 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all ve | medium | 6.4 | 0% |
| CVE-2023-31144 | craftcms/cms | craftcms/cms vulnerable to cross site scripting in RSS feed widget | medium | 6.1 | 0% |
| CVE-2023-6027 | elijaa/phpmemcacheadmin | PHPMemcachedAdmin vulnerable to cross-site scripting (XSS) via improper encoding | medium | 6.1 | 0% |
| CVE-2024-11684 | kudos-donations (WordPress plugin) | The Kudos Donations – Easy donations and payments with Mollie plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ' | medium | 6.1 | 0% |
| CVE-2024-50637 | unopim/unopim | UnoPim Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2023-6530 | tj-shortcodes (WordPress plugin) | The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2023-5295 | facebook-comment-by-vivacity (WordPress plugin) | The Comments by Startbit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vivafbcomment' shortcode in versions up to, | medium | 6.4 | 0% |
| CVE-2023-7071 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2024-2128 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-2256 | oik (WordPress plugin) | The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact_button and bw_butto | medium | 6.4 | 0% |
| CVE-2024-2399 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions | medium | 6.4 | 0% |
| CVE-2024-1589 | sendpress (WordPress plugin) | The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privi | medium | 6.1 | 0% |
| CVE-2024-6223 | send-email-only-on-reply-to-my-comment (WordPress plugin) | The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back | medium | 6.1 | 0% |
| CVE-2024-2118 | social-media-share-buttons-\&-social-sharing-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which | medium | 5.9 | 0% |
| CVE-2023-6165 | restrict-usernames-emails-characters (WordPress plugin) | The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow | medium | 4.8 | 0% |
| CVE-2024-26481 | getkirby/cms | Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field | medium | 4.2 | 0% |
| CVE-2026-54087 | easycorp/easyadmin-bundle | EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField | high | 7.6 | 0% |
| CVE-2023-5615 | skype-online-status (WordPress plugin) | The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all | medium | 6.4 | 0% |
| CVE-2023-6747 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes i | medium | 6.4 | 0% |
| CVE-2024-0698 | easyappointments (WordPress plugin) | The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-1348 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parame | medium | 6.4 | 0% |
| CVE-2024-1357 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_tim | medium | 6.4 | 0% |
| CVE-2024-1533 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML Element in | medium | 6.4 | 0% |
| CVE-2024-2280 | better-elementor-addons (WordPress plugin) | The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget link URL values in all versions | medium | 6.4 | 0% |
| CVE-2024-2328 | real-media-library-lite (WordPress plugin) | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image | medium | 6.4 | 0% |
| CVE-2024-2925 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget | medium | 6.4 | 0% |
| CVE-2024-3267 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_price_list shortcode in all v | medium | 6.4 | 0% |
| CVE-2024-10858 | jetpack (WordPress plugin) | The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed a | medium | 6.1 | 0% |
| CVE-2024-0691 | filebird (WordPress plugin) | The FileBird plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported folder titles in all versions up to, and includi | medium | 5.5 | 0% |
| CVE-2023-49170 | captainform (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captainform Forms by CaptainForm – For | high | 7.1 | 0% |
| CVE-2023-49187 | adifier (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads W | high | 7.1 | 0% |
| CVE-2023-6781 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions | medium | 6.4 | 0% |
| CVE-2024-10684 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all vers | medium | 6.1 | 0% |
| CVE-2024-6339 | phlox (WordPress theme) | The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including | medium | 6.1 | 0% |
| CVE-2024-8713 | kodex-posts-likes (WordPress plugin) | The Kodex Posts likes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria | medium | 6.1 | 0% |
| CVE-2024-8730 | exit-notifier (WordPress plugin) | The Exit Notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate e | medium | 6.1 | 0% |
| CVE-2024-8731 | leira-cron-jobs (WordPress plugin) | The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escap | medium | 6.1 | 0% |
| CVE-2024-8737 | pdf-thumbnail-generator (WordPress plugin) | The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without app | medium | 6.1 | 0% |
| CVE-2023-1067 | pimcore/pimcore | Pimcore vulnerable to Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2023-1429 | pimcore/pimcore | Cross-site Scripting (XSS) in Document Types | medium | 5.4 | 0% |
| CVE-2023-6141 | essential-real-estate (WordPress plugin) | The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other thing | medium | 5.4 | 0% |
| CVE-2023-7084 | voting-record (WordPress plugin) | The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such | medium | 5.4 | 0% |
| CVE-2024-2402 | better-comments (WordPress plugin) | The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 5.4 | 0% |