Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2229 | rduplicator (WordPress plugin) | The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 2.0 due | high | 8.8 | 1% |
| CVE-2023-32121 | zero-spam-for-wordpress (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Highfivery LLC Zero Spam for WordPress | high | 7.6 | 1% |
| CVE-2023-35911 | contact-form-generator (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creative Solutions Contact Form Genera | high | 8.5 | 1% |
| CVE-2023-28788 | advanced-page-visit-counter (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit | high | 7.1 | 1% |
| CVE-2014-125051 | himiklab/yii2-jqgrid-widget | himiklab yii2-jqgrid-widget vulnerable to SQL Injection | critical | 9.8 | 1% |
| CVE-2023-30848 | pimcore/pimcore | SQL Injection in Admin Search Find API | high | 8.8 | 1% |
| CVE-2022-4935 | wc-multivendor-marketplace (WordPress plugin) | The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3. | high | 8.8 | 1% |
| CVE-2013-10023 | editorial-calendar (WordPress plugin) | A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerabil | medium | 6.3 | 1% |
| CVE-2014-125099 | i-recommend-this (WordPress plugin) | A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerabilit | medium | 6.3 | 1% |
| CVE-2023-5645 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading | high | 8.8 | 1% |
| CVE-2024-1514 | wp-e-commerce (WordPress plugin) | The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up t | critical | 9.8 | 1% |
| CVE-2024-9874 | poll-maker (WordPress plugin) | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ | medium | 4.9 | 1% |
| CVE-2023-36508 | contact-form-to-db (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by Best | high | 7.6 | 1% |
| CVE-2021-4308 | webpa/webpa | WebPA SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2015-10018 | dbrisinajumi/d2files | DBRisinajumi d2files SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2024-1317 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to SQL I | high | 8.8 | 1% |
| CVE-2007-10003 | the-hackers-diet (WordPress plugin) | A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects s | medium | 6.3 | 1% |
| CVE-2012-10011 | hd-flv-player (WordPress plugin) | A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the funct | medium | 6.3 | 1% |
| CVE-2014-125101 | portfolio-gallery (WordPress plugin) | A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. Th | medium | 6.3 | 1% |
| CVE-2015-10111 | watu-quiz (WordPress plugin) | A vulnerability was found in Watu Quiz Plugin up to 2.6.7 on WordPress. It has been rated as critical. This issue affects the function watu_ | medium | 6.3 | 1% |
| CVE-2015-10124 | most-popular-posts-widget (WordPress plugin) | A vulnerability was found in Most Popular Posts Widget Plugin up to 0.8 on WordPress. It has been classified as critical. Affected is the fu | medium | 6.3 | 1% |
| CVE-2023-29096 | contact-form-to-db (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by Best | high | 8.5 | 1% |
| CVE-2016-15020 | liftkit/database | SQL Injection in liftkit/database | critical | 9.8 | 1% |
| CVE-2021-4262 | mgallegos/laravel-jqgrid | laravel-jqgrid vulnerable to SQL Injection | critical | 9.8 | 1% |
| CVE-2023-3023 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, | high | 7.2 | 1% |
| CVE-2024-0786 | enhanced-e-commerce-for-woocommerce-store (WordPress plugin) | The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to ti | high | 8.8 | 1% |
| CVE-2023-5761 | burst-statistics (WordPress plugin) | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter | critical | 9.8 | 1% |
| CVE-2024-5756 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | critical | 9.8 | 1% |
| CVE-2023-35910 | quasar-form (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Cont | high | 8.5 | 1% |
| CVE-2024-3067 | wp-product-feed-manager (WordPress plugin) | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and in | high | 7.2 | 1% |
| CVE-2024-6809 | simple-video-directory (WordPress plugin) | The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statemen | critical | 9.8 | 1% |
| CVE-2023-36529 | houzez (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPr | critical | 9.9 | 1% |
| CVE-2023-45074 | advanced-page-visit-counter (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit | high | 8.5 | 1% |
| CVE-2024-9130 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ paramet | high | 7.2 | 1% |
| CVE-2024-40614 | egroupware/egroupware | EGroupware mishandles an ORDER BY clause | medium | 6.5 | 1% |
| CVE-2023-45069 | video-gallery (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Video Gallery by Total-Soft Video Gall | high | 7.6 | 1% |
| CVE-2026-35168 | devcode-it/openstamanager | OpenSTAManager: SQL Injection via Aggiornamenti Module | high | 8.8 | 1% |
| CVE-2020-26623 | gilacms/gila | Gila CMS SQL Injection | medium | 6.5 | 1% |
| CVE-2020-26624 | gilacms/gila | Gila CMS SQL Injection vulnerability | low | 3.8 | 1% |
| CVE-2020-26625 | gilacms/gila | Gila CMS SQL Injection vulnerability | low | 3.8 | 1% |
| CVE-2015-10077 | webbuilders-group/silverstripe-kapost-bridge | SQL injection in webbuilders-group silverstripe-kapost-bridge | critical | 9.8 | 1% |
| CVE-2023-39524 | prestashop/prestashop | PrestaShop boolean SQL injection | medium | 6.7 | 1% |
| CVE-2026-54348 | froxlor/froxlor | Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration | high | 7.2 | 1% |
| CVE-2024-0610 | woo-payment-gateway-for-piraeus-bank (WordPress plugin) | The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'MerchantReference | critical | 9.8 | 1% |
| CVE-2024-48224 | funadmin/funadmin | SQL injection in funadmin | high | 7.5 | 1% |
| CVE-2024-1118 | podlove-subscribe-button (WordPress plugin) | The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subsc | high | 8.8 | 1% |
| CVE-2026-55634 | pimcore/pimcore | Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name | critical | 9.9 | 1% |
| CVE-2026-55416 | pimcore/pimcore | Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration | high | 8.8 | 1% |
| CVE-2024-8855 | wordpress-auction (WordPress plugin) | The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allow | critical | 9.8 | 1% |
| CVE-2024-0365 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statemen | medium | 6.5 | 1% |