Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8500 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters | medium | 5.4 | 0% |
| CVE-2024-0625 | wpfront-notification-bar (WordPress plugin) | The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-options[cus | medium | 4.4 | 0% |
| CVE-2024-1245 | concrete5/concrete5 | Concrete CMS vulnerable to stored XSS in file tags and description attributes | low | 2.4 | 0% |
| CVE-2024-0334 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attribute of a link in several Elemen | medium | 6.4 | 0% |
| CVE-2024-0586 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-1278 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | medium | 6.4 | 0% |
| CVE-2024-1293 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the embedded media custom block in all versio | medium | 6.4 | 0% |
| CVE-2024-13323 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-1363 | easy-accordion-free (WordPress plugin) | The Easy Accordion – Best Accordion FAQ Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acco | medium | 6.4 | 0% |
| CVE-2024-1684 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-1948 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-1996 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versions | medium | 6.4 | 0% |
| CVE-2022-1418 | social-stickers (WordPress plugin) | The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does no | medium | 6.1 | 0% |
| CVE-2024-0585 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 5.4 | 0% |
| CVE-2024-0871 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Widget 'fl_builder_data[node_preview][link | medium | 5.4 | 0% |
| CVE-2024-3939 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 5.4 | 0% |
| CVE-2024-4094 | simple-share-buttons-adder (WordPress plugin) | The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privi | medium | 5.4 | 0% |
| CVE-2024-4372 | carousel-slider (WordPress plugin) | The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low | medium | 5.4 | 0% |
| CVE-2024-3261 | strong-testimonials (WordPress plugin) | The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them ba | medium | 4.8 | 0% |
| CVE-2024-5169 | video-widget (WordPress plugin) | The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-6724 | magic-post-thumbnail (WordPress plugin) | The Generate Images WordPress plugin before 5.2.8 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-6888 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whic | medium | 4.8 | 0% |
| CVE-2024-9600 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2023-5357 | instagram-for-wordpress (WordPress plugin) | The Instagram for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and includin | medium | 6.4 | 0% |
| CVE-2024-9502 | master-addons (WordPress plugin) | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnera | medium | 6.4 | 0% |
| CVE-2023-5354 | awesome-support (WordPress plugin) | The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-4752 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 5.9 | 0% |
| CVE-2024-0659 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Si | medium | 5.5 | 0% |
| CVE-2023-33736 | dcat/laravel-admin | Dcat-Admin vulnerable to Stored Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2024-1487 | contest-gallery (WordPress plugin) | The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users wi | medium | 5.4 | 0% |
| CVE-2023-1197 | uvdesk/community-skeleton | uvdesk/community-skeleton vulnerable to Stored Cross-site Scripting | medium | 4.8 | 0% |
| CVE-2024-5172 | expert-invoice (WordPress plugin) | The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-7955 | starbox (WordPress plugin) | The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-0898 | chat-bubble (WordPress plugin) | The Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back plugin for WordPress is vulnerable to | medium | 4.4 | 0% |
| CVE-2024-7512 | concrete5/concrete5 | Concrete CMS vulnerable to Stored Cross-site Scripting | low | 2.0 | 0% |
| CVE-2021-46875 | ezsystems/ezplatform-kernel, ezsystems/ezpublish-kernel | Cross-site scripting in eZ Platform Kernel | high | 0.0 | 0% |
| CVE-2024-30201 | wp-smart-import (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows | high | 7.1 | 0% |
| CVE-2024-32149 | jobs-for-wordpress (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Jobs for WordPress allows Re | high | 7.1 | 0% |
| CVE-2023-45607 | wordpress-popular-posts (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions. | medium | 6.5 | 0% |
| CVE-2024-1046 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2024-0821 | cost-of-goods-for-woocommerce (WordPress plugin) | The Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2024-10879 | forumwp (WordPress plugin) | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg | medium | 6.1 | 0% |
| CVE-2024-3547 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2024-47617 | sulu/sulu | Injection of arbitrary HTML/JavaScript code through the media download URL | medium | 6.1 | 0% |
| CVE-2024-3999 | eazydocs (WordPress plugin) | The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-6094 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-8283 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2024-25874 | enhavo/enhavo-app | Enhavo Cross-site Scripting vulnerability | medium | 0.0 | 0% |
| CVE-2023-7167 | persian-fonts (WordPress plugin) | The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 6.1 | 0% |
| CVE-2024-0973 | widget-for-social-page-feeds (WordPress plugin) | The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privi | medium | 6.1 | 0% |