Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-46823 | imagelinks (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum ImageLinks Interactive Image B | high | 7.6 | 1% |
| CVE-2023-0895 | wp-coder (WordPress plugin) | The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in ver | high | 7.2 | 1% |
| CVE-2025-62519 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality | high | 7.2 | 1% |
| CVE-2023-2237 | wp-replicate-post (WordPress plugin) | The WP Replicate Post plugin for WordPress is vulnerable to SQL Injection via the post_id parameter in versions up to, and including, 4.0.2 | high | 8.8 | 1% |
| CVE-2023-3677 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and incl | high | 8.8 | 1% |
| CVE-2024-13479 | ltl-freight-quotes-sefl-edition (WordPress plugin) | The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameter | high | 7.5 | 1% |
| CVE-2024-13483 | ltl-freight-quotes-saia-edition (WordPress plugin) | The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameter | high | 7.5 | 1% |
| CVE-2024-43436 | moodle/moodle | Moodle vulnerable to site administration SQL injection via XMLDB editor | high | 7.2 | 1% |
| CVE-2023-30849 | pimcore/pimcore | SQL Injection in Translation Export API | high | 8.8 | 1% |
| CVE-2023-30850 | pimcore/pimcore | SQL Injection in Admin Translations API | high | 8.8 | 1% |
| CVE-2023-5428 | image-vertical-reel-scroll-slideshow (WordPress plugin) | The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, a | high | 8.8 | 1% |
| CVE-2023-5429 | information-reel (WordPress plugin) | The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 d | high | 8.8 | 1% |
| CVE-2023-5430 | jquery-news-ticker (WordPress plugin) | The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 | high | 8.8 | 1% |
| CVE-2023-5431 | left-right-image-slideshow-gallery (WordPress plugin) | The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and | high | 8.8 | 1% |
| CVE-2023-5433 | message-ticker (WordPress plugin) | The Message ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.2 due | high | 8.8 | 1% |
| CVE-2023-5466 | wp-anything-slider (WordPress plugin) | The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 | high | 8.8 | 1% |
| CVE-2024-13489 | ltl-freight-quotes-odfl-edition (WordPress plugin) | The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' p | high | 7.5 | 1% |
| CVE-2023-5434 | superb-slideshow-gallery (WordPress plugin) | The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including | high | 8.8 | 1% |
| CVE-2023-5435 | up-down-image-slideshow-gallery (WordPress plugin) | The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and in | high | 8.8 | 1% |
| CVE-2023-5436 | vertical-marquee-plugin (WordPress plugin) | The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 7.1 du | high | 8.8 | 1% |
| CVE-2023-5437 | wp-fade-in-text-news (WordPress plugin) | The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12 | high | 8.8 | 1% |
| CVE-2023-5438 | wp-image-slideshow (WordPress plugin) | The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 | high | 8.8 | 1% |
| CVE-2023-5439 | wp-photo-text-slider-50 (WordPress plugin) | The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, | high | 8.8 | 1% |
| CVE-2023-5464 | jquery-accordion-slideshow (WordPress plugin) | The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and includi | high | 8.8 | 1% |
| CVE-2021-37823 | opencart/opencart | OpenCart SQL injection vulnerability | medium | 4.9 | 1% |
| CVE-2014-125091 | polls-cp (WordPress plugin) | A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unkno | medium | 4.7 | 1% |
| CVE-2024-1173 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time- | high | 7.2 | 1% |
| CVE-2023-2841 | advanced-local-pickup-for-woocommerce (WordPress plugin) | The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up | high | 7.2 | 1% |
| CVE-2023-5465 | popup-with-fancybox (WordPress plugin) | The Popup with fancybox plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.5 | high | 8.8 | 1% |
| CVE-2023-5663 | news-announcement-scroll (WordPress plugin) | The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including | high | 8.8 | 1% |
| CVE-2024-1893 | easy-property-listings (WordPress plugin) | The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in a | high | 8.8 | 1% |
| CVE-2024-0685 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection | medium | 5.9 | 1% |
| CVE-2024-6027 | themify-wc-product-filter (WordPress plugin) | The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in al | critical | 9.8 | 1% |
| CVE-2021-24151 | wp-editor (WordPress plugin) | The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL i | high | 7.2 | 1% |
| CVE-2022-4290 | cyr3lat (WordPress plugin) | The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, an | high | 8.8 | 1% |
| CVE-2023-49750 | couponis (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoonthemes Couponis - Affiliate & Sub | critical | 9.3 | 1% |
| CVE-2024-1068 | 404-solution (WordPress plugin) | The 404 Solution WordPress plugin before 2.35.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leadin | high | 7.2 | 1% |
| CVE-2023-29432 | houzez (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPr | high | 8.2 | 1% |
| CVE-2023-24781 | funadmin/funadmin | SQL Injection in Funadmin | critical | 9.8 | 1% |
| CVE-2025-45346 | bacula-web/bacula-web | Bacula-web SQL Injection Vulnerability | high | 8.1 | 1% |
| CVE-2025-46337 | adodb/adodb-php | SQL injection in ADOdb PostgreSQL driver pg_insert_id() method | critical | 10.0 | 1% |
| CVE-2023-24773 | funadmin/funadmin | SQL Injection in Funadmin | critical | 9.8 | 1% |
| CVE-2023-24777 | funadmin/funadmin | SQL Injection in Funadmin | critical | 9.8 | 1% |
| CVE-2023-24782 | funadmin/funadmin | SQL Injection in Funadmin | critical | 9.8 | 1% |
| CVE-2023-48764 | guardgiant (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection Word | high | 7.6 | 1% |
| CVE-2024-6847 | chatbot-with-chatgpt (WordPress plugin) | The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, | critical | 9.8 | 1% |
| CVE-2023-24410 | contact-form (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Conta | medium | 5.5 | 1% |
| CVE-2021-24626 | chameleon-css (WordPress plugin) | The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticate | high | 8.8 | 1% |
| CVE-2024-1206 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up to, and including, 9. | high | 8.8 | 1% |
| CVE-2023-26015 | mappress (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for Wor | high | 7.1 | 1% |