Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3300 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, | high | 7.2 | 1% |
| CVE-2020-10803 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection vulnerability | medium | 5.4 | 1% |
| CVE-2022-2593 | better-search-replace (WordPress plugin) | The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL quer | high | 7.2 | 1% |
| CVE-2021-24754 | mainwp-child-reports (WordPress plugin) | The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement | high | 7.2 | 1% |
| CVE-2011-3583 | typo3/cms | Typo3 SQL injection due to faulty prepared statements | critical | 9.8 | 1% |
| CVE-2021-24458 | popup-box (WordPress plugin) | The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or valida | high | 8.8 | 1% |
| CVE-2021-24459 | survey-maker (WordPress plugin) | The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby | high | 8.8 | 1% |
| CVE-2021-24460 | popup-box (WordPress plugin) | The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orde | high | 8.8 | 1% |
| CVE-2021-24461 | faq-builder (WordPress plugin) | The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before | high | 8.8 | 1% |
| CVE-2021-24462 | photo-gallery (WordPress plugin) | The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4. | high | 8.8 | 1% |
| CVE-2021-24463 | image-slider (WordPress plugin) | The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or | high | 8.8 | 1% |
| CVE-2021-24506 | slider-hero (WordPress plugin) | The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of | high | 8.8 | 1% |
| CVE-2021-24580 | side-menu (WordPress plugin) | The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in S | high | 8.8 | 1% |
| CVE-2021-24575 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before usi | high | 8.8 | 1% |
| CVE-2021-24748 | email-before-download (WordPress plugin) | The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before usin | high | 8.8 | 1% |
| CVE-2021-24755 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQ | high | 8.8 | 1% |
| CVE-2021-24829 | visitor-traffic-real-time-statistics (WordPress plugin) | The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_ind | high | 8.8 | 1% |
| CVE-2021-24846 | ni-woocommerce-custom-order-status (WordPress plugin) | The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, ava | high | 8.8 | 1% |
| CVE-2021-24847 | seo-redirection-301-redirect-manager (WordPress plugin) | The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any aut | high | 8.8 | 1% |
| CVE-2021-24848 | mediamatic (WordPress plugin) | The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not | high | 8.8 | 1% |
| CVE-2020-7759 | pimcore/pimcore | SQL Injection in pimcore | high | 7.2 | 1% |
| CVE-2019-16194 | centreon/centreon | SQL injection in Centreon | critical | 9.8 | 1% |
| CVE-2024-23119 | centreon/centreon | Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability | high | 8.8 | 1% |
| CVE-2022-1123 | leaflet-maps-marker (WordPress plugin) | The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters be | high | 7.2 | 1% |
| CVE-2019-12149 | silverstripe/registry, silverstripe/restfulserver | silverstripe restfulserver and registry modules SQL injection vulnerability | critical | 9.8 | 1% |
| CVE-2013-5322 | bednee/cooluri | CoolURI extension for TYPO3 vulnerable to SQL Injection | high | 0.0 | 1% |
| CVE-2019-10671 | librenms/librenms | SQL Injection in LibreNMS | high | 8.8 | 1% |
| CVE-2021-24957 | advanced-page-visit-counter (WordPress plugin) | The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the | high | 8.8 | 1% |
| CVE-2022-1182 | visual-slide-box-builder (WordPress plugin) | The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL stateme | high | 8.8 | 1% |
| CVE-2020-25700 | moodle/moodle | SQL Injection in moodle | medium | 6.5 | 1% |
| CVE-2021-24484 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or | high | 7.2 | 1% |
| CVE-2021-24497 | giveaway (WordPress plugin) | The Giveaway WordPress plugin through 1.2.2 is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary | high | 7.2 | 1% |
| CVE-2021-24662 | game-server-status (WordPress plugin) | The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, le | high | 7.2 | 1% |
| CVE-2021-24199 | wpdatatables (WordPress plugin) | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean- | medium | 6.5 | 1% |
| CVE-2021-24200 | wpdatatables (WordPress plugin) | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean- | medium | 6.5 | 1% |
| CVE-2022-3302 | spam-protection\,-antispam\,-firewall (WordPress plugin) | The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statem | high | 7.2 | 1% |
| CVE-2020-18155 | intelliants/subrion | SQL Injection in Subrion CMS | critical | 9.8 | 1% |
| CVE-2021-24345 | sendit (WordPress plugin) | The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sani | medium | 6.6 | 1% |
| CVE-2021-24606 | availability-calendar (WordPress plugin) | The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL s | high | 8.8 | 1% |
| CVE-2021-24669 | maz-loader (WordPress plugin) | The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortc | high | 8.8 | 1% |
| CVE-2021-24758 | email-log (WordPress plugin) | The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before | high | 8.8 | 1% |
| CVE-2021-24835 | frontend-manager-for-woocommerce-along-with-bookings-subscription-listings-compatible (WordPress plugin) | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used i | high | 8.8 | 1% |
| CVE-2021-25064 | wow-countdowns (WordPress plugin) | The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, lead | high | 7.2 | 1% |
| CVE-2021-27672 | tribalsystems/zenario | SQL Injection in tribalsystems/zenario | medium | 4.9 | 1% |
| CVE-2021-24952 | conversios (WordPress plugin) | The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_p | high | 8.8 | 1% |
| CVE-2021-25054 | wpcalc (WordPress plugin) | The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an | high | 8.8 | 1% |
| CVE-2022-0410 | visitor-statistics (WordPress plugin) | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a | high | 8.8 | 1% |
| CVE-2022-22735 | simple-quotation (WordPress plugin) | The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lack | high | 8.8 | 1% |
| CVE-2022-2958 | badgos (WordPress plugin) | The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions ava | high | 8.8 | 1% |
| CVE-2022-3494 | complianz (WordPress plugin) | The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL | high | 8.8 | 1% |