Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1685 | five-minute-webshop (WordPress plugin) | The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQ | medium | 4.9 | 1% |
| CVE-2022-1691 | realty-workstation (WordPress plugin) | The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL stateme | medium | 4.9 | 1% |
| CVE-2022-45820 | learnpress (WordPress plugin) | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. | critical | 9.1 | 1% |
| CVE-2019-8130 | magento/community-edition, magento/product-community-edition | Magento SQL injection vulnerability | high | 8.8 | 1% |
| CVE-2019-8134 | magento/community-edition, magento/product-community-edition | Magento SQL injection via marketing account with access to email templates variables | high | 8.8 | 1% |
| CVE-2009-4803 | svewap/a21glossary, wapplersystems/a21glossary | Accessibility Glossary (a21glossary) SQL injection vulnerability | high | 0.0 | 1% |
| CVE-2021-43822 | jackalope/jackalope-doctrine-dbal | SQL injection in jackalope/jackalope-doctrine-dbal | high | 8.5 | 1% |
| CVE-2024-13481 | ltl-freight-quotes (WordPress plugin) | The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' p | high | 7.5 | 1% |
| CVE-2024-23646 | pimcore/admin-ui-classic-bundle | SQL Injection in Admin download files as zip | high | 8.8 | 1% |
| CVE-2021-38302 | ecodev/newsletter | SQL injection in TYPO3 extension | medium | 4.0 | 1% |
| CVE-2022-36394 | contest-gallery (WordPress plugin) | Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress. | high | 7.6 | 1% |
| CVE-2025-1648 | yawave (WordPress plugin) | The Yawave plugin for WordPress is vulnerable to SQL Injection via the 'lbid' parameter in all versions up to, and including, 2.9.1 due to i | high | 7.5 | 1% |
| CVE-2023-1016 | intuitive-custom-post-order (WordPress plugin) | The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.4.1, due to insuff | medium | 6.6 | 1% |
| CVE-2024-28107 | phpmyfaq/phpmyfaq | phpMyFAQ SQL injections at insertentry & saveentry | high | 8.8 | 1% |
| CVE-2024-9022 | poll-wp (WordPress plugin) | The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in | high | 7.2 | 1% |
| CVE-2022-33960 | social-share-buttons-by-supsystic (WordPress plugin) | Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= | high | 8.5 | 1% |
| CVE-2023-5108 | easy-newsletter-signups (WordPress plugin) | The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statem | high | 7.2 | 1% |
| CVE-2022-4546 | mapwiz (WordPress plugin) | The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a | high | 7.2 | 1% |
| CVE-2024-1799 | gamipress (WordPress plugin) | The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to | high | 8.8 | 1% |
| CVE-2022-4547 | conditional-payment-methods-for-woocommerce (WordPress plugin) | The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using | high | 7.2 | 1% |
| CVE-2024-0709 | cryptocurrency-price-ticker-widget (WordPress plugin) | The Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coinslist' parameter in | critical | 9.8 | 1% |
| CVE-2025-10042 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due | medium | 5.9 | 1% |
| CVE-2023-0579 | yet-another-related-posts-plugin (WordPress plugin) | The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, | high | 8.8 | 1% |
| CVE-2023-1471 | wp-popup-banners (WordPress plugin) | The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter in versions up to, and including, 1.2 | high | 8.8 | 1% |
| CVE-2023-2756 | pimcore/customer-management-framework-bundle | pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query | high | 7.2 | 1% |
| CVE-2018-5960 | tribalsystems/zenario | SQL Injection in Zenario 7.1-7.6 | high | 8.8 | 1% |
| CVE-2023-2655 | contact-form-maker (WordPress plugin) | The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement | high | 7.2 | 1% |
| CVE-2022-4151 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET p | medium | 6.5 | 1% |
| CVE-2022-4161 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start P | medium | 6.5 | 1% |
| CVE-2024-37906 | admidio/admidio | Admidio has Blind SQL Injection in ecard_send.php | critical | 9.9 | 1% |
| CVE-2021-36625 | dolibarr/dolibarr | SQL Injection in Dolibarr | high | 8.8 | 1% |
| CVE-2023-28663 | formidable-pro2pdf (WordPress plugin) | The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ param | high | 8.8 | 1% |
| CVE-2021-32474 | moodle/moodle | Moodle Blind SQL injection possible via MNet authentication | high | 7.2 | 1% |
| CVE-2023-4999 | horizontal-scrolling-announcement (WordPress plugin) | The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode | high | 8.8 | 1% |
| CVE-2022-29305 | helloxz/imgurl | SQL injection in helloxz/imgurl | high | 8.1 | 1% |
| CVE-2023-0254 | simple-membership-wp-user-import (WordPress plugin) | The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and | high | 7.2 | 1% |
| CVE-2012-4383 | contao/core | Contao core SQL Injection Vulnerability | high | 8.8 | 1% |
| CVE-2022-30998 | homepage-product-organizer-for-woocommerce (WordPress plugin) | Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer f | critical | 9.1 | 1% |
| CVE-2023-2338 | pimcore/pimcore | SQL Injection in AssetController | high | 8.8 | 1% |
| CVE-2022-0983 | moodle/moodle | SQL Injection in Moodle | high | 8.8 | 1% |
| CVE-2023-4776 | wpschoolpress (WordPress plugin) | The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did | high | 8.8 | 1% |
| CVE-2019-8143 | magento/community-edition, magento/product-community-edition | Magento Injection vulnerability via email templates | medium | 6.5 | 1% |
| CVE-2022-4118 | bitcoin-\/-altcoin-payment-gateway-for-woocommerce (WordPress plugin) | The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise a | critical | 9.8 | 1% |
| CVE-2023-22727 | cakephp/cakephp, cakephp/database | CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection | critical | 9.8 | 1% |
| CVE-2024-0952 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time- | high | 7.2 | 1% |
| CVE-2019-12239 | wp-booking-system (WordPress plugin) | The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that r | high | 7.2 | 1% |
| CVE-2012-10009 | 404like (WordPress plugin) | A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage | high | 7.3 | 1% |
| CVE-2023-3673 | pimcore/pimcore | Pimcore SQL Injection vulnerability | high | 7.2 | 1% |
| CVE-2023-0388 | random-text (WordPress plugin) | The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading | high | 8.8 | 1% |
| CVE-2021-24928 | rearrange-woocommerce-products (WordPress plugin) | The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor | medium | 6.5 | 1% |