Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9323 | 404-to-301 (WordPress plugin) | The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection. | critical | 9.8 | 46% |
| CVE-2021-24442 | poll\,-survey\,-questionnaire-and-voting-system (WordPress plugin) | The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST | critical | 9.8 | 46% |
| CVE-2023-2114 | nex-forms (WordPress plugin) | The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concate | high | 7.2 | 45% |
| CVE-2022-0332 | moodle/moodle | SQL injection in Moodle | critical | 9.8 | 44% |
| CVE-2022-0479 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a S | critical | 9.8 | 44% |
| CVE-2022-1281 | photo-gallery (WordPress plugin) | The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL qu | critical | 9.8 | 43% |
| CVE-2019-14314 | nextgen-gallery (WordPress plugin) | A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vuln | critical | 9.8 | 43% |
| CVE-2022-0773 | documentor (WordPress plugin) | The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement an | critical | 9.8 | 43% |
| CVE-2023-28662 | gift-vouchers (WordPress plugin) | The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerabilit | critical | 9.8 | 42% |
| CVE-2018-3811 | smart-google-code-inserter (WordPress plugin) | SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to exe | critical | 9.8 | 42% |
| CVE-2020-24913 | qcubed/qcubed | qcubed SQL injection vulnerability in profile.php via the strQuery parameter | critical | 9.8 | 41% |
| CVE-2023-1730 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allo | critical | 9.8 | 41% |
| CVE-2015-2065 | contus-video-gallery (WordPress plugin) | SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPr | high | 7.5 | 40% |
| CVE-2022-2754 | ketchup-restaurant-reservations (WordPress plugin) | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using the | critical | 9.8 | 39% |
| CVE-2020-5504 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection in user accounts page | high | 8.8 | 39% |
| CVE-2021-24750 | visitor-statistics (WordPress plugin) | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails | high | 8.8 | 38% |
| CVE-2022-0739 | bookingpress (WordPress plugin) | The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constr | critical | 9.8 | 37% |
| CVE-2022-1905 | events-made-easy (WordPress plugin) | The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via | critical | 9.8 | 37% |
| CVE-2024-4434 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions | critical | 9.8 | 37% |
| CVE-2022-4230 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection | high | 8.8 | 36% |
| CVE-2024-5315 | dolibarr/dolibarr | Dolibarr vulnerable to SQL Injection | critical | 9.1 | 35% |
| CVE-2022-0349 | notificationx (WordPress plugin) | The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading | critical | 9.8 | 34% |
| CVE-2022-0651 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type | critical | 9.8 | 32% |
| CVE-2021-24340 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did | high | 7.5 | 30% |
| CVE-2018-12636 | better-wp-security (WordPress plugin) | The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via th | high | 7.2 | 29% |
| CVE-2018-14058 | pimcore/pimcore | Pimcore SQLi Vulnerability | medium | 6.5 | 29% |
| CVE-2024-5765 | wpstickybar (WordPress plugin) | The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an | critical | 9.8 | 27% |
| CVE-2022-35628 | in2code/lux | SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation" | critical | 9.8 | 27% |
| CVE-2019-16119 | photo-gallery (WordPress plugin) | SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries | critical | 9.8 | 25% |
| CVE-2023-5591 | librenms/librenms | SQL injection in librenms/librenms | high | 7.8 | 24% |
| CVE-2022-31101 | prestashop/blockwishlist | BlockWishList SQL Injection vulnerability | high | 8.1 | 23% |
| CVE-2021-44567 | francoisjacquet/rosariosis | SQL injection in francoisjacquet/rosariosis | critical | 9.8 | 23% |
| CVE-2017-15367 | bacula-web/bacula-web | Bacula-web SQL Injection Vulnerabilities | critical | 9.8 | 23% |
| CVE-2019-7139 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition SQLi Vulnerability | critical | 9.8 | 22% |
| CVE-2021-26599 | impresscms/impresscms | SQL Injection in ImpressCMS | critical | 9.8 | 21% |
| CVE-2019-14348 | joomsport (WordPress plugin) | The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_seaso | critical | 9.8 | 21% |
| CVE-2024-32480 | librenms/librenms | LibreNMS vulnerable to a Time-Based Blind SQL injection leads to database extraction | high | 7.2 | 20% |
| CVE-2022-1556 | stafflist (WordPress plugin) | The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when search | critical | 9.8 | 20% |
| CVE-2023-24775 | funadmin/funadmin | SQL Injection in Funadmin | critical | 9.8 | 20% |
| CVE-2024-6457 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author | critical | 9.8 | 20% |
| CVE-2024-32461 | librenms/librenms | LibreNMS vulnerable to SQL injection time-based leads to database extraction | high | 8.8 | 19% |
| CVE-2024-21514 | opencart/opencart | SQL injection in opencart | high | 7.4 | 19% |
| CVE-2018-20556 | booking-calendar (WordPress plugin) | SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the | high | 8.8 | 19% |
| CVE-2024-2879 | layerslider (WordPress plugin) | The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to | critical | 9.8 | 18% |
| CVE-2021-24786 | download-monitor (WordPress plugin) | The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQ | high | 7.2 | 17% |
| CVE-2021-25076 | wp-user-frontend (WordPress plugin) | The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in | high | 8.8 | 17% |
| CVE-2024-8669 | backuply (WordPress plugin) | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to | critical | 9.1 | 17% |
| CVE-2022-0747 | infographic-maker (WordPress plugin) | The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement vi | critical | 9.8 | 15% |
| CVE-2022-0434 | page-view-count (WordPress plugin) | The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement vi | critical | 9.8 | 15% |
| CVE-2021-24285 | cars-seller-auto-classifieds-script (WordPress plugin) | The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticat | critical | 9.8 | 15% |