Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-5298 | october/backend | Reflected XSS when importing CSV in OctoberCMS | medium | 4.0 | 1% |
| CVE-2023-4145 | pimcore/customer-management-framework-bundle | pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name | medium | 6.5 | 1% |
| CVE-2026-54002 | getkirby/cms | Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` | high | 0.0 | 1% |
| CVE-2024-8505 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ para | medium | 6.4 | 0% |
| CVE-2024-4459 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in al | medium | 6.4 | 0% |
| CVE-2024-3519 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up t | medium | 6.1 | 0% |
| CVE-2024-2618 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versio | medium | 6.4 | 0% |
| CVE-2024-2750 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button wid | medium | 6.4 | 0% |
| CVE-2024-3162 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all version | medium | 6.4 | 0% |
| CVE-2026-42458 | openmage/magento-lts | Magento LTS: Reflected XSS - Import -> Data Flow (profiles) | medium | 0.0 | 0% |
| CVE-2023-6446 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and i | medium | 4.4 | 0% |
| CVE-2025-62414 | bagisto/bagisto | bagisto has Cross Site Scripting (XSS) in Create New Customer | medium | 6.9 | 0% |
| CVE-2025-62415 | bagisto/bagisto | bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML) | medium | 6.9 | 0% |
| CVE-2025-62418 | bagisto/bagisto | bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG) | medium | 6.9 | 0% |
| CVE-2025-49137 | elmsln/haxcms | Hax CMS Stored Cross-Site Scripting vulnerability | high | 8.5 | 0% |
| CVE-2026-34598 | yeswiki/yeswiki | YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter" | high | 0.0 | 0% |
| CVE-2025-65961 | contao/core-bundle | Contao is vulnerable to cross-site scripting in templates | low | 3.3 | 0% |