Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-29410 | hermit (WordPress plugin) | Authenticated SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers with Subscriber or h | high | 7.4 | 1% |
| CVE-2023-24774 | funadmin/funadmin | Funadmin vulnerable to SQL injection | critical | 9.8 | 1% |
| CVE-2024-2018 | wp-activity-log (WordPress plugin) | The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and in | high | 8.8 | 1% |
| CVE-2023-0765 | gallery (WordPress plugin) | The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Inject | high | 8.8 | 1% |
| CVE-2023-26325 | reviewx (WordPress plugin) | The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterVal | high | 8.8 | 1% |
| CVE-2023-28659 | waiting (WordPress plugin) | The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc | high | 8.8 | 1% |
| CVE-2023-28660 | events-made-easy (WordPress plugin) | The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' pa | high | 8.8 | 1% |
| CVE-2023-28661 | wp-popup-banners (WordPress plugin) | The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' paramete | high | 8.8 | 1% |
| CVE-2019-10763 | pimcore/pimcore | Data leakage via SQL Injection in Pimcore | medium | 6.5 | 1% |
| CVE-2023-30545 | prestashop/prestashop | Arbitrary file read via SQL injection | high | 7.7 | 1% |
| CVE-2014-125029 | ttskch/pagination-service-provider | PaginationServiceProvider SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2023-28438 | pimcore/pimcore | Pimcore vulnerable to improper quoting of filters in Custom Reports | medium | 6.2 | 1% |
| CVE-2023-28108 | pimcore/pimcore | Improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model | high | 7.9 | 1% |
| CVE-2023-6035 | eazydocs (WordPress plugin) | The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an | high | 8.8 | 1% |
| CVE-2023-6030 | logdash-activity-log (WordPress plugin) | The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed | medium | 5.4 | 1% |
| CVE-2023-2482 | responsive-css-editor (WordPress plugin) | The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, | high | 7.2 | 1% |
| CVE-2023-2592 | formcraft (WordPress plugin) | The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to | high | 7.2 | 1% |
| CVE-2023-5082 | sitemap-by-click5 (WordPress plugin) | The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statemen | high | 7.2 | 1% |
| CVE-2024-10628 | quiz-maker (WordPress plugin) | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions u | high | 7.5 | 1% |
| CVE-2022-3827 | centreon/centreon | Centreon vulnerable to SQL Injection | critical | 9.8 | 1% |
| CVE-2023-5709 | widget-twitter (WordPress plugin) | The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 | high | 8.8 | 1% |
| CVE-2023-2188 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 | high | 7.2 | 1% |
| CVE-2023-2484 | ldap-login-for-intranet-sites (WordPress plugin) | The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in vers | high | 7.2 | 1% |
| CVE-2021-25109 | futurio-extra (WordPress plugin) | The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to e | low | 2.7 | 1% |
| CVE-2021-36392 | moodle/moodle | Moodle SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2023-2607 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions | high | 7.2 | 1% |
| CVE-2022-29419 | 3xsocializer (WordPress plugin) | SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocializer plugin <= 0.98.22 at WordPress possible for users with a low role like a s | medium | 6.0 | 1% |
| CVE-2024-2344 | avada (WordPress theme) | The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to i | high | 7.2 | 1% |
| CVE-2023-38221 | magento/community-edition, magento/project-community-edition | Magento Open Source allows SQL Injection | high | 8.0 | 1% |
| CVE-2023-38249 | magento/community-edition, magento/project-community-edition | Magento Open Source allows SQL Injection | high | 8.0 | 1% |
| CVE-2023-38250 | magento/community-edition, magento/project-community-edition | Magento Open Source allows SQL Injection | high | 8.0 | 1% |
| CVE-2022-25607 | fv-wordpress-flowplayer (WordPress plugin) | Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (ver | medium | 6.6 | 1% |
| CVE-2024-1982 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the | medium | 6.5 | 1% |
| CVE-2023-6967 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all versions up to, and incl | high | 8.8 | 1% |
| CVE-2024-1203 | enhanced-e-commerce-for-woocommerce-store (WordPress plugin) | The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQ | high | 8.8 | 1% |
| CVE-2024-1990 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQ | high | 8.8 | 1% |
| CVE-2024-3055 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via th | high | 8.8 | 1% |
| CVE-2019-16682 | sfroemken/url_redirect | url_redirect for Typo3 SQLi Vulnerability | high | 7.3 | 1% |
| CVE-2022-45822 | advanced-booking-calendar (WordPress plugin) | Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress. | critical | 10.0 | 1% |
| CVE-2023-2201 | web-directory-free (WordPress plugin) | The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.6.8 due | high | 8.8 | 1% |
| CVE-2023-24780 | funadmin/funadmin | SQL Injection in Funadmin | critical | 9.8 | 1% |
| CVE-2022-1684 | cube-slider (WordPress plugin) | The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, lea | low | 2.7 | 1% |
| CVE-2022-1686 | five-minute-webshop (WordPress plugin) | The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when | low | 2.7 | 1% |
| CVE-2022-1687 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement v | low | 2.7 | 1% |
| CVE-2022-1688 | note-press (WordPress plugin) | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via th | low | 2.7 | 1% |
| CVE-2022-1689 | note-press (WordPress plugin) | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when upd | low | 2.7 | 1% |
| CVE-2022-1690 | note-press (WordPress plugin) | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL stateme | low | 2.7 | 1% |
| CVE-2022-38148 | silverstripe/framework | Blind SQL Injection via GridFieldSortableHeader | high | 8.8 | 1% |
| CVE-2023-5336 | ipanorama-360-virtual-tour-builder-lite (WordPress plugin) | The iPanorama 360 – WordPress Virtual Tour Builder plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in version | high | 8.8 | 1% |
| CVE-2023-35132 | moodle/moodle | Moodle vulnerable to SQL Injection | medium | 6.3 | 1% |