Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24521 | side-menu (WordPress plugin) | The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when bu | high | 7.2 | 2% |
| CVE-2021-24341 | english-islamic-calendar (WordPress plugin) | When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST paramete | high | 8.8 | 2% |
| CVE-2014-5184 | stripshow (WordPress plugin) | SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated adminis | medium | 6.5 | 2% |
| CVE-2014-5186 | all-video-gallery (WordPress plugin) | SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators | medium | 6.5 | 2% |
| CVE-2020-21808 | nukeviet/nukeviet | NukeViet SQL Injection vulnerability via topicsid parameter | critical | 9.8 | 2% |
| CVE-2015-7791 | welcart-e-commerce (WordPress plugin) | Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users | medium | 6.3 | 2% |
| CVE-2021-24550 | broken-link-manager (WordPress plugin) | The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL | high | 7.2 | 2% |
| CVE-2021-24552 | simple-events-calendar (WordPress plugin) | The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it | high | 7.2 | 2% |
| CVE-2021-24553 | timeline-calendar (WordPress plugin) | The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL sta | high | 7.2 | 2% |
| CVE-2016-10949 | relevanssi (WordPress plugin) | The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization. | high | 8.8 | 2% |
| CVE-2020-21809 | nukeviet/nukeviet | NukeViet SQL Injection vulnerability | critical | 9.8 | 2% |
| CVE-2017-18602 | ibps-online-exam (WordPress plugin) | The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter. | high | 8.8 | 2% |
| CVE-2019-9568 | forminator (WordPress plugin) | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=formina | medium | 6.5 | 2% |
| CVE-2026-28501 | wwbn/avideo | AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php | critical | 9.8 | 2% |
| CVE-2021-24337 | video-embed-box (WordPress plugin) | The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validat | high | 8.8 | 2% |
| CVE-2021-24391 | cashtomer (WordPress plugin) | An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to | high | 8.8 | 2% |
| CVE-2021-24520 | out-of-stock-message-for-woocommerce (WordPress plugin) | The Stock in & out WordPress plugin through 1.0.4 lacks proper sanitization before passing variables to an SQL request, making it vulnerable | high | 8.8 | 2% |
| CVE-2021-24630 | schreikasten (WordPress plugin) | The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the | high | 8.8 | 2% |
| CVE-2021-24631 | unlimited-popups (WordPress plugin) | The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, av | high | 8.8 | 2% |
| CVE-2021-24726 | wp-simple-booking-calendar (WordPress plugin) | The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calend | high | 8.8 | 2% |
| CVE-2021-24348 | side-menu (WordPress plugin) | The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users take | high | 7.2 | 2% |
| CVE-2019-5715 | silverstripe/framework | Silverstripe Framework SQLi Vulnerability | critical | 9.8 | 2% |
| CVE-2021-24772 | stream (WordPress plugin) | The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard befo | high | 8.8 | 2% |
| CVE-2022-1683 | amtythumb (WordPress plugin) | The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, | high | 8.8 | 2% |
| CVE-2021-24336 | flightlog (WordPress plugin) | The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement | high | 7.2 | 2% |
| CVE-2021-24390 | alipay (WordPress plugin) | A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or | high | 7.2 | 2% |
| CVE-2021-24392 | club-management-software (WordPress plugin) | An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated b | high | 7.2 | 2% |
| CVE-2021-24393 | comment-highlighter (WordPress plugin) | A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting | high | 7.2 | 2% |
| CVE-2021-24394 | easy-testimonial-manager (WordPress plugin) | An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting t | high | 7.2 | 2% |
| CVE-2021-24395 | embed-youtube-video (WordPress plugin) | The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to | high | 7.2 | 2% |
| CVE-2021-24628 | wow-forms (WordPress plugin) | The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when dele | high | 7.2 | 2% |
| CVE-2021-24629 | post-content-xmlrpc (WordPress plugin) | The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL state | high | 7.2 | 2% |
| CVE-2021-24747 | seo-booster (WordPress plugin) | The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as | high | 7.2 | 2% |
| CVE-2021-24753 | rich-review (WordPress plugin) | The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page | high | 7.2 | 2% |
| CVE-2015-0894 | all-in-one-wp-security-and-firewall (WordPress plugin) | SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute ar | medium | 6.0 | 2% |
| CVE-2018-17566 | topthink/framework | ThinkPHP SQL injection vulnerability | critical | 9.8 | 2% |
| CVE-2021-44135 | pagekit/pagekit | SQL injection in pagekit/pagekit | critical | 9.8 | 2% |
| CVE-2022-0478 | event-manager-and-tickets-selling-for-woocommerce (WordPress plugin) | The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg p | high | 8.8 | 2% |
| CVE-2020-35012 | events-manager (WordPress plugin) | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an | high | 7.2 | 2% |
| CVE-2021-24511 | product-feed-on-woocommerce (WordPress plugin) | The fetch_product_ajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a `product_id` POST parameter w | high | 7.2 | 2% |
| CVE-2021-24844 | affiliates-manager (WordPress plugin) | The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admi | high | 7.2 | 2% |
| CVE-2016-10947 | post-indexer (WordPress plugin) | The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin. | high | 7.2 | 2% |
| CVE-2021-24919 | wicked-folders (WordPress plugin) | The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in | high | 8.8 | 2% |
| CVE-2022-0411 | asgaros-forum (WordPress plugin) | The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a | high | 8.8 | 2% |
| CVE-2021-24396 | gseor (WordPress plugin) | A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before insert | high | 7.2 | 2% |
| CVE-2021-24397 | microcopy (WordPress plugin) | The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter use | high | 7.2 | 2% |
| CVE-2021-24398 | responsive-3d-slider (WordPress plugin) | The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escape | high | 7.2 | 2% |
| CVE-2021-24399 | the-sorter (WordPress plugin) | The check_order function of The Sorter WordPress plugin through 1.0 uses an `area_id` parameter which is not sanitised, escaped or validated | high | 7.2 | 2% |
| CVE-2021-24400 | wp-display-users (WordPress plugin) | The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an `id` parameter which is not sanitised, escaped or val | high | 7.2 | 2% |
| CVE-2021-24403 | wpagecontact (WordPress plugin) | The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or valid | high | 7.2 | 2% |