Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-22406 | shopware/core, shopware/platform | Blind SQL injection in shopware | critical | 9.3 | 1% |
| CVE-2024-10687 | contest-gallery (WordPress plugin) | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plug | critical | 9.8 | 1% |
| CVE-2024-12311 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL s | medium | 6.5 | 1% |
| CVE-2024-0594 | awesome-support (WordPress plugin) | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to union-based SQL Injection via the 'q' parame | high | 8.8 | 1% |
| CVE-2023-30750 | cm-popup (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin | high | 8.5 | 1% |
| CVE-2024-12773 | altra-side-menu (WordPress plugin) | The Altra Side Menu WordPress plugin through 2.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin | high | 7.2 | 1% |
| CVE-2024-11722 | acf-frontend-form-element (WordPress plugin) | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and | medium | 5.9 | 1% |
| CVE-2024-2954 | action-network (WordPress plugin) | The Action Network plugin for WordPress is vulnerable to SQL Injection via the 'bulk-action' parameter in version 1.4.3 due to insufficient | high | 7.2 | 1% |
| CVE-2026-79752 | cakephp/cakephp, cakephp/database | CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection | critical | 0.0 | 1% |
| CVE-2021-24704 | orange-form (WordPress plugin) | In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared | high | 8.8 | 1% |
| CVE-2024-7548 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versio | high | 8.8 | 1% |
| CVE-2024-11372 | connexion-logs (WordPress plugin) | The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admi | high | 7.2 | 1% |
| CVE-2024-0405 | burst-statistics (WordPress plugin) | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via | high | 7.2 | 1% |
| CVE-2024-10499 | ai-engine (WordPress plugin) | The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a | high | 7.2 | 1% |
| CVE-2026-63221 | codeigniter4/framework | CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions | critical | 9.4 | 1% |
| CVE-2024-0913 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time- | high | 7.2 | 1% |
| CVE-2015-10126 | easy2map-photos (WordPress plugin) | A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The | medium | 6.3 | 1% |
| CVE-2024-42357 | shopware/core, shopware/platform | Shopware vulnerable to blind SQL-injection in DAL aggregations | high | 7.3 | 1% |
| CVE-2024-11260 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_st | high | 7.5 | 1% |
| CVE-2024-2341 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the k | high | 8.8 | 1% |
| CVE-2024-10862 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'search_para | medium | 4.9 | 1% |
| CVE-2024-2342 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the c | high | 8.8 | 1% |
| CVE-2022-25775 | mautic/core | Mautic SQL Injection in dynamic Reports | medium | 6.6 | 1% |
| CVE-2024-5606 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the | high | 8.8 | 1% |
| CVE-2023-49752 | adifier (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads | critical | 9.3 | 1% |
| CVE-2024-11267 | jsp-store-locator (WordPress plugin) | The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing use | high | 8.8 | 1% |
| CVE-2024-11269 | ahathat (WordPress plugin) | The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin | high | 7.2 | 1% |
| CVE-2024-12735 | advance-post-prefix (WordPress plugin) | The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing | high | 7.2 | 1% |
| CVE-2024-9831 | taskbuilder (WordPress plugin) | The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins | high | 7.2 | 1% |
| CVE-2024-10540 | bookingpress-appointment-booking (WordPress plugin) | The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'se | medium | 5.3 | 1% |
| CVE-2024-48222 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 1% |
| CVE-2024-7766 | adicon-server (WordPress plugin) | The Adicon Server WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins | high | 7.2 | 1% |
| CVE-2024-11729 | kivicare-clinic-management-system (WordPress plugin) | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service | medium | 6.5 | 1% |
| CVE-2024-5605 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_clou | high | 8.8 | 1% |
| CVE-2024-13477 | ltl-freight-quotes-unishippers-edition (WordPress plugin) | The LTL Freight Quotes – Unishippers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions | high | 7.5 | 1% |
| CVE-2024-30478 | bulletin (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bulletin WordPress Announcement & Noti | high | 7.6 | 1% |
| CVE-2025-0821 | bit-assist (WordPress plugin) | Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 | medium | 6.5 | 1% |
| CVE-2026-25495 | craftcms/cms | Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` | high | 0.0 | 1% |
| CVE-2025-26533 | moodle/moodle | Moodle has a SQL injection risk in course search module list filter | high | 8.1 | 1% |
| CVE-2024-7150 | slider-wd (WordPress plugin) | The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all v | high | 8.8 | 1% |
| CVE-2024-5314 | dolibarr/dolibarr | Dolibarr vulnerable to SQL Injection | critical | 9.1 | 1% |
| CVE-2023-5315 | wp-gmappity-easy-google-maps (WordPress plugin) | The Google Maps made Simple plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, | high | 8.8 | 1% |
| CVE-2024-1795 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the | high | 8.8 | 1% |
| CVE-2024-48225 | funadmin/funadmin | SQL injection in funadmin | critical | 9.1 | 1% |
| CVE-2024-1797 | wp-ulike (WordPress plugin) | The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to SQL Injection via the 'status' and 'id' attri | high | 8.8 | 1% |
| CVE-2024-48218 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 1% |
| CVE-2024-48223 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 1% |
| CVE-2024-48226 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 1% |
| CVE-2025-4578 | file-provider (WordPress plugin) | The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an | critical | 9.8 | 1% |
| CVE-2024-1776 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'form-id' parameter in all versio | high | 7.2 | 1% |