Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-15659 | pie-register (WordPress plugin) | The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969. | critical | 9.8 | 2% |
| CVE-2021-36916 | hide-my-wp (WordPress plugin) | The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieve | high | 8.6 | 2% |
| CVE-2024-3217 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all vers | high | 8.8 | 2% |
| CVE-2022-0694 | advanced-booking-calendar (WordPress plugin) | The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL sta | critical | 9.8 | 2% |
| CVE-2015-9325 | visitors-online (WordPress plugin) | The visitors-online plugin before 0.4 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9326 | wp-business-intelligence-lite (WordPress plugin) | The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2016-10904 | olimometer (WordPress plugin) | The olimometer plugin before 2.57 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2017-12650 | loginizer (WordPress plugin) | SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header. | critical | 9.8 | 2% |
| CVE-2020-6009 | learndash (WordPress plugin) | LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection. | critical | 9.8 | 2% |
| CVE-2018-21003 | buddyforms (WordPress plugin) | The buddyforms plugin before 2.2.8 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2021-24361 | location-manager (WordPress plugin) | In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate som | critical | 9.8 | 2% |
| CVE-2017-12199 | ultimate-product-catalog (WordPress plugin) | The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue | critical | 9.8 | 2% |
| CVE-2020-10802 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection vulnerability | high | 8.0 | 2% |
| CVE-2020-20120 | topthink/thinkphp | SQL Injection in topthink/thinkphp | critical | 9.8 | 2% |
| CVE-2012-6719 | sharebar (WordPress plugin) | The sharebar plugin before 1.2.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9313 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element. | critical | 9.8 | 2% |
| CVE-2015-9315 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.1 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2016-10889 | nextgen-gallery (WordPress plugin) | The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name. | critical | 9.8 | 2% |
| CVE-2016-10916 | appointment-booking-calendar (WordPress plugin) | The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319. | critical | 9.8 | 2% |
| CVE-2016-10921 | gallery-photo-gallery (WordPress plugin) | The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2019-1010104 | quick-chat (WordPress plugin) | TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The compone | critical | 9.8 | 2% |
| CVE-2019-14801 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. | critical | 9.8 | 2% |
| CVE-2017-18548 | note-press (WordPress plugin) | The note-press plugin before 0.1.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9333 | cforms2 (WordPress plugin) | The cforms2 plugin before 14.6.10 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2017-18573 | simple-login-log (WordPress plugin) | The simple-login-log plugin before 1.1.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2014-10379 | duplicate-post (WordPress plugin) | The duplicate-post plugin before 2.6 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2014-10387 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9330 | wp-all-import (WordPress plugin) | The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9335 | limit-attempts (WordPress plugin) | The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling. | critical | 9.8 | 2% |
| CVE-2015-9344 | link-log (WordPress plugin) | The link-log plugin before 2.1 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9352 | wp-polls (WordPress plugin) | The wp-polls plugin before 2.72 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2016-10909 | booking-calendar-contact-form (WordPress plugin) | The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2021-38324 | sp-rental-manager (WordPress plugin) | The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the ~/user/shortcodes.php file whic | high | 8.2 | 2% |
| CVE-2022-0836 | sema-api (WordPress plugin) | The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an A | critical | 9.8 | 2% |
| CVE-2014-10376 | i-recommend-this (WordPress plugin) | The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2017-18570 | cforms2 (WordPress plugin) | The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries. | critical | 9.8 | 2% |
| CVE-2017-18571 | search-everything (WordPress plugin) | The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-201 | critical | 9.8 | 2% |
| CVE-2019-15025 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page. | critical | 9.8 | 2% |
| CVE-2017-10842 | baserproject/basercms | baserCMS SQL Injection vulnerability | critical | 9.8 | 2% |
| CVE-2018-19281 | centreon/centreon | Centreon allows SNMP trap SQL Injection | critical | 9.8 | 2% |
| CVE-2020-10817 | custom-searchable-data-entry-system (WordPress plugin) | The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. N | high | 8.8 | 2% |
| CVE-2015-9458 | searchterms-tagging-2 (WordPress plugin) | The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploita | high | 7.2 | 2% |
| CVE-2014-9442 | cart66-lite (WordPress plugin) | SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users | medium | 6.5 | 2% |
| CVE-2024-13322 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' paramete | high | 7.5 | 2% |
| CVE-2022-0657 | 5-stars-rating-funnel (WordPress plugin) | The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead id | critical | 9.8 | 2% |
| CVE-2022-0782 | donations (WordPress plugin) | The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via | critical | 9.8 | 2% |
| CVE-2017-7886 | dolibarr/dolibarr | Dolibarr SQL Injection in doli/theme/eldy/style.css.php via the lang parameter | critical | 9.8 | 2% |
| CVE-2020-20625 | sliced-invoices (WordPress plugin) | Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via cor | high | 7.5 | 2% |
| CVE-2021-24182 | tutor-lms (WordPress plugin) | The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before | medium | 6.5 | 2% |
| CVE-2021-24183 | tutor-lms (WordPress plugin) | The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 | medium | 6.5 | 2% |