Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24774 | check-\&-log-email (WordPress plugin) | The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them | high | 7.2 | 1% |
| CVE-2021-24860 | bsk-pdf-manager (WordPress plugin) | The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL s | high | 7.2 | 1% |
| CVE-2021-24861 | quotes-collection (WordPress plugin) | The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement | high | 7.2 | 1% |
| CVE-2021-24889 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privile | high | 7.2 | 1% |
| CVE-2021-24858 | wp-cookie-user-info (WordPress plugin) | The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL s | high | 7.2 | 1% |
| CVE-2022-0255 | database-backup (WordPress plugin) | The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL | high | 7.2 | 1% |
| CVE-2022-0887 | easy-social-icons (WordPress plugin) | The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an | high | 7.2 | 1% |
| CVE-2017-14238 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in admin/menus/edit.php | critical | 9.8 | 1% |
| CVE-2017-14242 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in don/list.php | critical | 9.8 | 1% |
| CVE-2010-5103 | typo3/cms | TYPO3 SQL Injection vulnerability | medium | 0.0 | 1% |
| CVE-2021-24777 | contact-form (WordPress plugin) | The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter whic | high | 7.2 | 1% |
| CVE-2021-25068 | sync-woocommerce-product-feed-to-google-shopping (WordPress plugin) | The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter which is not properly | high | 7.2 | 1% |
| CVE-2022-2269 | website-file-changes-monitor (WordPress plugin) | The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement vi | critical | 9.8 | 1% |
| CVE-2022-0190 | ad-invalid-click-protector (WordPress plugin) | The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action. | high | 8.8 | 1% |
| CVE-2021-24456 | quiz-maker (WordPress plugin) | The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQ | high | 7.2 | 1% |
| CVE-2021-25037 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an inter | medium | 6.5 | 1% |
| CVE-2022-1800 | export-any-wordpress-data-to-xml\/csv (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data bef | high | 7.2 | 1% |
| CVE-2021-24877 | mainwp-child (WordPress plugin) | The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leadi | high | 7.2 | 1% |
| CVE-2021-24778 | tradetracker-store (WordPress plugin) | The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before ins | high | 7.2 | 1% |
| CVE-2021-4208 | exportfeed (WordPress plugin) | The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statemen | high | 7.2 | 1% |
| CVE-2022-0267 | adrotate (WordPress plugin) | The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adro | high | 7.2 | 1% |
| CVE-2021-32790 | woocommerce (WordPress plugin) | Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCo | medium | 4.9 | 1% |
| CVE-2020-15886 | munkireport/reportdata | MunkiReport reportdata module SQL injection vulnerability | high | 8.8 | 1% |
| CVE-2020-15887 | munkireport/softwareupdate | MunkiReport Software Update module is vulnerable to SQL injection | high | 8.8 | 1% |
| CVE-2017-12946 | easy-modal (WordPress plugin) | classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, id | high | 7.2 | 1% |
| CVE-2017-12947 | easy-modal (WordPress plugin) | classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, | high | 7.2 | 1% |
| CVE-2019-8127 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SQLi Vulnerability | high | 8.8 | 1% |
| CVE-2022-1472 | better-find-and-replace (WordPress plugin) | The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using th | high | 7.2 | 1% |
| CVE-2021-24181 | tutor-lms (WordPress plugin) | The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vul | medium | 6.5 | 1% |
| CVE-2021-24185 | tutor-lms (WordPress plugin) | The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to | medium | 6.5 | 1% |
| CVE-2021-24186 | tutor-lms (WordPress plugin) | The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin | medium | 6.5 | 1% |
| CVE-2008-4524 | adaptcms/adaptcms | AdaptCMS SQL Injection vulnerability | high | 0.0 | 1% |
| CVE-2022-3395 | wp-all-export (WordPress plugin) | The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing us | high | 8.8 | 1% |
| CVE-2021-24142 | 301-redirects (WordPress plugin) | Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" | high | 7.2 | 1% |
| CVE-2022-2559 | fluent-support (WordPress plugin) | The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an | high | 7.2 | 1% |
| CVE-2021-24138 | adrotate (WordPress plugin) | Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This require | medium | 5.5 | 1% |
| CVE-2013-4682 | bvbmedia/multishop | Multishop extension for TYPO3 has SQL Injection vulnerability | high | 0.0 | 1% |
| CVE-2013-4748 | georgringer/news | News system (news) extension for TYPO3 vulnerable to SQL Injection | high | 0.0 | 1% |
| CVE-2021-24864 | wp-cloudy (WordPress plugin) | The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the | high | 8.8 | 1% |
| CVE-2023-47637 | pimcore/pimcore | Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt() | high | 8.8 | 1% |
| CVE-2024-13478 | ltl-freight-quotes-ups-edition (WordPress plugin) | The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' paramet | high | 7.5 | 1% |
| CVE-2022-3131 | search-logger (WordPress plugin) | The Search Logger WordPress plugin through 0.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading | high | 7.2 | 1% |
| CVE-2018-5695 | wpjobboard (WordPress plugin) | The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a | high | 7.2 | 1% |
| CVE-2021-24140 | ajax-load-more (WordPress plugin) | Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with | high | 7.2 | 1% |
| CVE-2018-18529 | topthink/framework | ThinkPHP SQLi Vulnerability | critical | 9.8 | 1% |
| CVE-2018-18530 | topthink/framework | ThinkPHP SQLi Vulnerability | critical | 9.8 | 1% |
| CVE-2018-5372 | testimonial-slider (WordPress plugin) | The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter). | high | 8.8 | 1% |
| CVE-2018-5373 | smooth-slider (WordPress plugin) | The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter). | high | 8.8 | 1% |
| CVE-2018-5374 | dbox-slider (WordPress plugin) | The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter). | high | 8.8 | 1% |
| CVE-2019-12465 | librenms/librenms | SQL Injection in LibreNMS | high | 8.1 | 1% |