Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-2221 | wpcom-member (WordPress plugin) | The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and in | high | 7.5 | 2% |
| CVE-2017-18514 | simple-login-log (WordPress plugin) | The simple-login-log plugin before 1.1.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9395 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action. | high | 8.8 | 2% |
| CVE-2015-9399 | wp-stats-dashboard (WordPress plugin) | The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection. | high | 7.2 | 2% |
| CVE-2010-1615 | moodle/moodle | Moodle vulnerable to SQL injection | high | 0.0 | 2% |
| CVE-2017-1002025 | add-edit-delete-listing-for-member-module (WordPress plugin) | Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input vi | high | 7.2 | 2% |
| CVE-2021-23405 | pimcore/pimcore | SQL injection in pimcore/pimcore | high | 8.8 | 2% |
| CVE-2021-24727 | stop-bad-bots (WordPress plugin) | The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard p | high | 8.8 | 2% |
| CVE-2021-24728 | paid-member-subscriptions (WordPress plugin) | The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its orde | high | 8.8 | 2% |
| CVE-2020-22452 | phpmyadmin/phpmyadmin | phpmyadmin contains SQL Injection vulnerability | critical | 9.8 | 2% |
| CVE-2017-1002026 | event-espresso-free (WordPress plugin) | Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input v | high | 8.8 | 2% |
| CVE-2026-46364 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha | critical | 9.8 | 2% |
| CVE-2023-30839 | prestashop/prestashop | SQL filter bypass leading to arbitrary write requests using "SQL Manager" | critical | 9.9 | 2% |
| CVE-2021-24949 | the-plus-addons-for-elementor (WordPress plugin) | The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option | critical | 9.8 | 2% |
| CVE-2019-12570 | server-status-by-hostname\/ip (WordPress plugin) | A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to | high | 8.8 | 2% |
| CVE-2017-6570 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6571 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6572 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6573 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6574 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6575 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6576 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6577 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2017-6578 | mail-masta (WordPress plugin) | A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects | high | 7.2 | 2% |
| CVE-2023-39526 | prestashop/prestashop | PrestaShop SQL manager vulnerability | critical | 9.1 | 2% |
| CVE-2018-18546 | topthink/framework | ThinkPHP SQLi Vulnerability | critical | 9.8 | 2% |
| CVE-2022-0258 | pimcore/pimcore | pimcore is vulnerable to SQL Injection | high | 8.3 | 2% |
| CVE-2015-1393 | photo-gallery (WordPress plugin) | SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary S | medium | 6.5 | 2% |
| CVE-2017-5346 | genix/cms | GeniXCMS SQL injection vulnerability | high | 7.2 | 2% |
| CVE-2019-15537 | cesnet/simplesamlphp-module-proxystatistics | SQL Injection in SimpleSAMLphp | critical | 9.8 | 2% |
| CVE-2014-2839 | gd-star-rating (WordPress plugin) | SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands | high | 7.5 | 2% |
| CVE-2021-24651 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. Whil | high | 7.5 | 2% |
| CVE-2021-24863 | stop-bad-bots (WordPress plugin) | The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not saniti | critical | 9.8 | 2% |
| CVE-2021-24866 | wp-data-access (WordPress plugin) | The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL state | critical | 9.8 | 2% |
| CVE-2021-24951 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when | critical | 9.8 | 2% |
| CVE-2021-21263 | illuminate/database, laravel/framework | Query Binding Exploitation | high | 7.2 | 2% |
| CVE-2018-11515 | wpforo (WordPress plugin) | The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. | critical | 9.8 | 2% |
| CVE-2020-8596 | participants-database (WordPress plugin) | participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vul | high | 7.5 | 2% |
| CVE-2016-10096 | genix/cms | GeniXCMS SQL injection vulnerability | high | 7.3 | 2% |
| CVE-2021-25007 | molie-instructure-canvas-linking-tool (WordPress plugin) | The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Inje | critical | 9.8 | 2% |
| CVE-2021-25070 | block-and-stop-bad-bots (WordPress plugin) | The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to r | critical | 9.8 | 2% |
| CVE-2022-1014 | wp-contacts-manager (WordPress plugin) | The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in | critical | 9.8 | 2% |
| CVE-2021-24303 | official-website-mini-program (WordPress plugin) | The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in | high | 8.8 | 2% |
| CVE-2022-0771 | sitesupercharger (WordPress plugin) | The SiteSuperCharger WordPress plugin before 5.2.0 does not validate, sanitise and escape various user inputs before using them in SQL state | critical | 9.8 | 2% |
| CVE-2020-12104 | wp-advanced-search (WordPress plugin) | The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql fi | high | 8.8 | 2% |
| CVE-2011-3130 | WordPress core | wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy quer | high | 7.5 | 2% |
| CVE-2021-24492 | handsome-testimonials-\&-reviews (WordPress plugin) | The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authent | high | 8.8 | 2% |
| CVE-2016-10939 | xtremelocator (WordPress plugin) | The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter. | high | 7.2 | 2% |
| CVE-2014-5183 | simple-retail-menus (WordPress plugin) | SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allow | medium | 6.5 | 2% |
| CVE-2017-12977 | photo-gallery (WordPress plugin) | The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related | high | 7.2 | 2% |