Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2583 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes befo | medium | 5.4 | 0% |
| CVE-2024-5074 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 5.4 | 0% |
| CVE-2023-2328 | pimcore/pimcore | Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition | medium | 5.2 | 0% |
| CVE-2024-5802 | url-shortener (WordPress plugin) | The URL Shortener by Myhop WordPress plugin through 1.0.17 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2023-2327 | pimcore/pimcore | Cross-site Scripting (XSS) in pimcore via DataObject Class date fields | medium | 4.0 | 0% |
| CVE-2024-7300 | bolt/bolt | Bolt CMS Cross-site Scripting vulnerability | low | 3.5 | 0% |
| CVE-2026-49279 | wwbn/avideo | WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) | high | 0.0 | 0% |
| CVE-2024-9650 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip’ parameter in all versions up to, and | medium | 6.5 | 0% |
| CVE-2023-4963 | ws-facebook-likebox (WordPress plugin) | The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in ver | medium | 6.4 | 0% |
| CVE-2023-5085 | advanced-menu-widget (WordPress plugin) | The Advanced Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'advMenu' shortcode in versions up to, and in | medium | 6.4 | 0% |
| CVE-2024-3333 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attributes of widgets in al | medium | 6.4 | 0% |
| CVE-2023-50828 | ultimate-dashboard (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ultimate Dashboard – Cu | medium | 5.9 | 0% |
| CVE-2023-1517 | pimcore/pimcore | Pimcore has Cross site Scripting vulnerability in Schedule tab of Documents | medium | 4.8 | 0% |
| CVE-2023-4925 | easy-forms-for-mailchimp (WordPress plugin) | The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privi | medium | 4.8 | 0% |
| CVE-2023-5181 | wp-discord-invite (WordPress plugin) | The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2023-5943 | wp-adv-quiz (WordPress plugin) | The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2023-5956 | wp-adv-quiz (WordPress plugin) | The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-6037 | wp-tripadvisor-review-slider (WordPress plugin) | The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2023-6163 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2023-6290 | seopress (WordPress plugin) | The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as a | medium | 4.8 | 0% |
| CVE-2023-6626 | product-enquiry-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | 0% |
| CVE-2023-6941 | official-opt-in-forms (WordPress plugin) | The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2023-7115 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-2263 | woocommerce-product-filter (WordPress plugin) | Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflecte | medium | 4.8 | 0% |
| CVE-2024-7132 | coblocks (WordPress plugin) | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which coul | medium | 4.8 | 0% |
| CVE-2025-61682 | mediawiki/semantic-media-wiki | Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes | high | 8.6 | 0% |
| CVE-2024-2867 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2024-4479 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordio | medium | 6.4 | 0% |
| CVE-2024-4619 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2024-5757 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url attribute within the pl | medium | 6.4 | 0% |
| CVE-2024-5787 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 6.4 | 0% |
| CVE-2023-6621 | post-smtp (WordPress plugin) | The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-10683 | contact-form-7-paypal-add-on (WordPress plugin) | The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query | medium | 6.1 | 0% |
| CVE-2024-9219 | share-button (WordPress plugin) | The WordPress Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with | medium | 6.1 | 0% |
| CVE-2024-9609 | learnpress-import-export (WordPress plugin) | The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via t | medium | 6.1 | 0% |
| CVE-2024-9896 | bbp-core (WordPress plugin) | The BBP Core – Expand bbPress powered forums with useful features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due t | medium | 6.1 | 0% |
| CVE-2023-1117 | pimcore/pimcore | Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config | medium | 5.4 | 0% |
| CVE-2024-1333 | responsive-pricing-table (WordPress plugin) | The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting | medium | 5.4 | 0% |
| CVE-2024-2404 | better-comments (WordPress plugin) | The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users s | medium | 5.4 | 0% |
| CVE-2024-6134 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the pag | medium | 5.4 | 0% |
| CVE-2024-9528 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.9 | 0% |
| CVE-2026-34571 | ci4-cms-erp/ci4ms | CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromi | critical | 9.9 | 0% |
| CVE-2023-7070 | email-encoder-bundle (WordPress plugin) | The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-3718 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all | medium | 6.4 | 0% |
| CVE-2024-4482 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-7122 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-7895 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in al | medium | 6.4 | 0% |
| CVE-2024-12177 | ai-image-alt-text-generator-for-wp (WordPress plugin) | The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all | medium | 6.1 | 0% |
| CVE-2024-12299 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, | medium | 6.1 | 0% |
| CVE-2024-13209 | redaxo/source | Stored XSS in REDAXO | medium | 5.4 | 0% |