Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-28329 | moodle/moodle | Moodle SQL Injection vulnerability | high | 8.8 | 1% |
| CVE-2022-42497 | api2cart-bridge-connector (WordPress plugin) | Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress. | critical | 10.0 | 1% |
| CVE-2010-3662 | typo3/cms-backend | TYPO3 SQL injection vulnerability on the backend | high | 8.8 | 1% |
| CVE-2021-24869 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL sta | high | 8.8 | 1% |
| CVE-2021-4340 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1. | critical | 9.8 | 1% |
| CVE-2021-24465 | meow-gallery (WordPress plugin) | The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available f | high | 8.1 | 1% |
| CVE-2021-24360 | yes\/no-chart (WordPress plugin) | The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing me | medium | 6.5 | 1% |
| CVE-2014-6295 | jbartels/wec-map, web-tp3/wec_map | WEC Map (wec_map) extension for TYPO3 allows SQL Injection | high | 0.0 | 1% |
| CVE-2023-3820 | pimcore/pimcore | Pimcore vulnerable to SQL Injection in Dataobjects sorting | high | 7.2 | 1% |
| CVE-2022-1064 | forkcms/forkcms | SQL Injection in Fork CMS | high | 8.8 | 1% |
| CVE-2024-27299 | phpmyfaq/phpmyfaq | phpMyFAQ SQL Injection at "Save News" | high | 8.8 | 1% |
| CVE-2022-3848 | wp-user-merger (WordPress plugin) | The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leadi | high | 8.8 | 1% |
| CVE-2021-25023 | speed-booster-pack (WordPress plugin) | The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter b | high | 7.2 | 1% |
| CVE-2020-14443 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in accountancy/customer/card.php | high | 8.8 | 1% |
| CVE-2024-13488 | ltl-freight-quotes-estes-edition (WordPress plugin) | The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' paramete | high | 7.5 | 1% |
| CVE-2023-30944 | moodle/moodle | Moodle SQL Injection vulnerability | high | 7.3 | 1% |
| CVE-2024-6172 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | critical | 9.8 | 1% |
| CVE-2023-4598 | wp-slimstat (WordPress plugin) | The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0. | high | 8.8 | 1% |
| CVE-2022-3915 | dokan (WordPress plugin) | The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a S | critical | 9.8 | 1% |
| CVE-2021-39351 | wp-bannerize (WordPress plugin) | The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin. | medium | 6.5 | 1% |
| CVE-2022-0153 | forkcms/forkcms | SQL Injection in Fork CMS | high | 7.5 | 1% |
| CVE-2022-4360 | wp-rss-by-publishers (WordPress plugin) | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, | high | 7.2 | 1% |
| CVE-2022-40315 | moodle/moodle | Moodle Minor SQL injection risk in admin user browsing | critical | 9.8 | 1% |
| CVE-2017-1000067 | modx/revolution | MODX Revolution blind SQL injection | high | 8.8 | 1% |
| CVE-2018-20713 | shopware/shopware | Shopware SQL Injection | high | 8.8 | 1% |
| CVE-2018-10225 | topthink/framework | thinkphp SQL Injection via the index.php s parameter | critical | 9.8 | 1% |
| CVE-2015-0270 | zendframework/zend-db, zendframework/zendframework | Zend Framework Allows SQL Injection | critical | 9.8 | 1% |
| CVE-2023-5041 | track-the-click (WordPress plugin) | The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them | high | 8.8 | 1% |
| CVE-2021-36898 | quiz-master-next (WordPress plugin) | Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress. | high | 7.5 | 1% |
| CVE-2010-4961 | dmk/webkitpdf | Webkit PDFs for TYPO3 has SQL Injection vulnerability | high | 0.0 | 1% |
| CVE-2021-28381 | fluidtypo3/vhs | SQL injection in vhs (aka VHS: Fluid ViewHelpers) | medium | 5.4 | 1% |
| CVE-2024-1981 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version 0.9 | critical | 9.8 | 1% |
| CVE-2021-21427 | openmage/magento-lts | Backport for CVE-2021-21024 Blind SQLi from Magento 2 | critical | 9.1 | 1% |
| CVE-2022-29411 | hermit (WordPress plugin) | SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers to execute SQLi attack via (&id). | high | 8.3 | 1% |
| CVE-2021-44779 | gwa-autoresponder (WordPress plugin) | Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&lis | high | 7.3 | 1% |
| CVE-2011-2715 | drupal/core | Drupal SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2010-0329 | in2code/powermail | TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors | high | 0.0 | 1% |
| CVE-2015-10122 | wp-donate (WordPress plugin) | A vulnerability was found in wp-donate Plugin up to 1.4 on WordPress. It has been classified as critical. This affects an unknown part of th | medium | 6.3 | 1% |
| CVE-2015-10100 | dynamic-widgets (WordPress plugin) | A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects so | medium | 6.3 | 1% |
| CVE-2010-3604 | in2code/powermail | powermail extension for TYPO3 vulnerable to SQL Injection | high | 0.0 | 1% |
| CVE-2022-4445 | fl3r-feelbox (WordPress plugin) | The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJ | critical | 9.8 | 1% |
| CVE-2023-3211 | wordpress-database-administrator (WordPress plugin) | The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a S | critical | 9.8 | 1% |
| CVE-2017-9436 | nilsteampassnet/teampass | TeamPass SQL injection in users.queries.php | critical | 9.8 | 1% |
| CVE-2024-13485 | ltl-freight-quotes-abf-freight-edition (WordPress plugin) | The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' pa | high | 7.5 | 1% |
| CVE-2015-10099 | cp-appointment-calendar (WordPress plugin) | A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function | medium | 6.3 | 1% |
| CVE-2017-18260 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability | high | 8.8 | 1% |
| CVE-2017-9839 | dolibarr/dolibarr | Dolibarr SQL injection via type parameter in product/stats/card.php | high | 8.8 | 1% |
| CVE-2013-4662 | civicrm/civicrm-core | CiviCRM SQL injection vulnerability via Quick Search API | medium | 0.0 | 1% |
| CVE-2024-4351 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing cap | high | 8.8 | 1% |
| CVE-2023-5640 | article-analytics (WordPress plugin) | The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX acti | critical | 9.8 | 1% |