Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24625 | spidercatalog (WordPress plugin) | The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard | high | 7.2 | 2% |
| CVE-2022-3246 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before | high | 8.8 | 2% |
| CVE-2017-14760 | event-espresso-lite (WordPress plugin) | SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for Wo | critical | 9.8 | 2% |
| CVE-2017-16558 | contao/contao, contao/core-bundle, contao/listing-bundle +1 more | Contao SQL injection in the backend and listing module | critical | 9.8 | 2% |
| CVE-2021-24137 | blog2social (WordPress plugin) | Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing | high | 8.8 | 2% |
| CVE-2021-24149 | modern-events-calendar-lite (WordPress plugin) | Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parame | high | 8.8 | 2% |
| CVE-2019-13570 | adrotate (WordPress plugin) | The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection. | high | 7.2 | 2% |
| CVE-2021-25045 | asgaros-forum (WordPress plugin) | The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when | high | 7.2 | 2% |
| CVE-2019-10766 | usmanhalalit/pixie | SQL Injection in usmanhalalit/pixie | critical | 9.8 | 1% |
| CVE-2022-2717 | joomsport-sports-league-results-management (WordPress plugin) | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' par | high | 7.2 | 1% |
| CVE-2022-2718 | joomsport-sports-league-results-management (WordPress plugin) | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' par | high | 7.2 | 1% |
| CVE-2021-25069 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statemen | high | 8.8 | 1% |
| CVE-2022-0420 | registrationmagic (WordPress plugin) | The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL stateme | high | 7.2 | 1% |
| CVE-2022-1006 | advanced-booking-calendar (WordPress plugin) | The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which coul | high | 7.2 | 1% |
| CVE-2022-1023 | podcast-importer-secondline (WordPress plugin) | The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQ | high | 7.2 | 1% |
| CVE-2023-0487 | my-sticky-elements (WordPress plugin) | The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement wh | high | 7.2 | 1% |
| CVE-2017-8377 | genix/cms | GeniXCMS SQL Injection | high | 8.8 | 1% |
| CVE-2017-9435 | dolibarr/dolibarr | Dolibarr ERP and CRM SQLi | critical | 9.8 | 1% |
| CVE-2023-5412 | image-horizontal-reel-scroll-slideshow (WordPress plugin) | The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, | high | 8.8 | 1% |
| CVE-2022-0383 | wp-review-slider (WordPress plugin) | The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could | high | 7.2 | 1% |
| CVE-2022-23911 | ap-custom-testimonial (WordPress plugin) | The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statem | high | 7.2 | 1% |
| CVE-2022-0362 | showdoc/showdoc | SQL Injection in showdoc | medium | 6.7 | 1% |
| CVE-2019-11512 | contao/contao, contao/core-bundle | Contao SQL injection in the file manager | critical | 9.8 | 1% |
| CVE-2021-24125 | contact-form-submissions (WordPress plugin) | Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET p | high | 7.2 | 1% |
| CVE-2022-25811 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before usin | high | 7.2 | 1% |
| CVE-2018-12534 | quick-chat (WordPress plugin) | A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress. | critical | 9.8 | 1% |
| CVE-2019-15570 | bedita/bedita | BEdita vulnerable to SQL injection | critical | 9.8 | 1% |
| CVE-2022-37333 | exceedone/exment, exceedone/laravel-admin | exceedone/exment and exceedone/laravel-admin SQL Injection vulnerability | high | 8.8 | 1% |
| CVE-2021-24131 | anti-spam (WordPress plugin) | Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulner | high | 7.2 | 1% |
| CVE-2021-4134 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID param | high | 7.2 | 1% |
| CVE-2020-14207 | divebook (WordPress plugin) | The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data fro | medium | 5.3 | 1% |
| CVE-2022-1219 | pimcore/pimcore | SQL Injection in Pimcore | high | 7.5 | 1% |
| CVE-2019-10762 | catfan/medoo | SQL Injection in medoo | critical | 9.8 | 1% |
| CVE-2021-44350 | topthink/framework | ThinkPHP5 SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2022-31092 | pimcore/pimcore | Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore | high | 8.1 | 1% |
| CVE-2021-24130 | wp-maps (WordPress plugin) | Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settin | high | 7.2 | 1% |
| CVE-2021-24451 | export-users-with-meta (WordPress plugin) | The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in | high | 7.2 | 1% |
| CVE-2021-43091 | yeswiki/yeswiki | SQL Injection in Yeswiki | high | 7.5 | 1% |
| CVE-2022-30599 | moodle/moodle | SQL injection in moodle | critical | 9.8 | 1% |
| CVE-2021-24483 | poll-maker (WordPress plugin) | The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or | high | 7.2 | 1% |
| CVE-2015-9353 | gigpress (WordPress plugin) | The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066. | high | 7.2 | 1% |
| CVE-2021-31777 | t3/dce | SQL Injection in t3/dce | high | 7.6 | 1% |
| CVE-2021-25030 | events-made-easy (WordPress plugin) | The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statemen | high | 8.8 | 1% |
| CVE-2021-24457 | portfolio-responsive-gallery (WordPress plugin) | The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-r | high | 8.8 | 1% |
| CVE-2022-40043 | centreon/centreon | Centreon SQL Injection vulnerability via esc_name parameter | high | 8.8 | 1% |
| CVE-2022-24752 | sylius/grid-bundle | DQL injection through sorting parameters blocked | critical | 9.8 | 1% |
| CVE-2024-7385 | wp-simple-html-sitemap (WordPress plugin) | The WordPress Simple HTML Sitemap plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and incl | critical | 9.1 | 1% |
| CVE-2015-7682 | pie-register (WordPress plugin) | Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote | medium | 6.5 | 1% |
| CVE-2021-24769 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL stat | high | 7.2 | 1% |
| CVE-2018-20678 | librenms/librenms | LibreNMS SQL Injection | high | 8.8 | 1% |