Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-4840 | likes-and-dislikes (WordPress plugin) | The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a | high | 7.5 | 1% |
| CVE-2023-38519 | mainwp-dashboard (WordPress plugin), mainwp/mainwp | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Ma | high | 7.6 | 1% |
| CVE-2024-8379 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statem | high | 7.2 | 1% |
| CVE-2024-4533 | kkprogressbar2 (WordPress plugin) | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allow | medium | 6.5 | 1% |
| CVE-2016-15040 | kento-post-view-counter (WordPress plugin) | The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kento_pvc_geo' parameter in versions up to, and inc | critical | 9.8 | 1% |
| CVE-2024-0608 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union | medium | 6.5 | 1% |
| CVE-2024-7607 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and incl | high | 8.8 | 1% |
| CVE-2024-0956 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time- | medium | 4.9 | 1% |
| CVE-2023-50845 | geodirectory (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory | high | 7.6 | 1% |
| CVE-2023-50856 | funnel-builder (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress | high | 7.6 | 1% |
| CVE-2023-52134 | geo-my-wordpress (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This is | high | 7.6 | 1% |
| CVE-2023-47236 | ipages-flipbook (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum iPages Flipbook For WordPress. | high | 7.6 | 1% |
| CVE-2025-0308 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | high | 7.5 | 1% |
| CVE-2026-25513 | facturascripts/facturascripts | FacturaScripts has SQL Injection in API ORDER BY Clause | high | 0.0 | 1% |
| CVE-2025-54119 | adodb/adodb-php | The ADOdb sqlite3 driver allows SQL injection | critical | 10.0 | 1% |
| CVE-2024-6666 | erp (WordPress plugin) | The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and includi | high | 8.8 | 1% |
| CVE-2026-25514 | facturascripts/facturascripts | FacturaScripts has SQL Injection in Autocomplete Actions | high | 0.0 | 1% |
| CVE-2024-8621 | daily-prayer-time-for-mosques (WordPress plugin) | The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'max_word' attribute of the 'quran_verse' shortcode in all | critical | 9.9 | 1% |
| CVE-2024-3518 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and inc | high | 8.8 | 1% |
| CVE-2024-12032 | tourfic (WordPress plugin) | The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vuln | medium | 6.5 | 1% |
| CVE-2023-50849 | e2pdf (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool f | high | 7.6 | 1% |
| CVE-2023-51547 | fluent-support (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – Wor | high | 7.6 | 1% |
| CVE-2025-1768 | squirrly-seo (WordPress plugin) | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, a | medium | 6.5 | 1% |
| CVE-2024-10247 | gallery-videos (WordPress plugin) | The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby par | high | 7.2 | 1% |
| CVE-2024-3604 | osm (WordPress plugin) | The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode | critical | 9.9 | 1% |
| CVE-2023-49825 | soledad (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Ne | high | 8.5 | 1% |
| CVE-2025-1572 | kivicare-clinic-management-system (WordPress plugin) | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all | medium | 6.5 | 1% |
| CVE-2024-12030 | wp-meta-data-filter-and-taxonomy-filter (WordPress plugin) | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' sh | medium | 6.5 | 1% |
| CVE-2024-13712 | pollin (WordPress plugin) | The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due | medium | 4.9 | 1% |
| CVE-2024-13533 | small-package-quotes-usps-edition (WordPress plugin) | The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up t | high | 7.5 | 1% |
| CVE-2024-36082 | music-store (WordPress plugin) | SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an adm | medium | 6.5 | 1% |
| CVE-2026-33767 | wwbn/avideo | AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query | high | 0.0 | 1% |
| CVE-2026-33352 | wwbn/avideo | AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) | critical | 9.8 | 1% |
| CVE-2024-11711 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via t | high | 7.5 | 1% |
| CVE-2024-3549 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter | critical | 9.9 | 1% |
| CVE-2024-12613 | passwords-manager (WordPress plugin) | The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX fuctions in all versio | high | 7.5 | 1% |
| CVE-2024-7349 | lifterlms (WordPress plugin) | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' pa | high | 7.2 | 1% |
| CVE-2024-6353 | woo-wallet (WordPress plugin) | The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'search[value]' parameter in all versions up to, and | high | 8.8 | 1% |
| CVE-2026-52771 | yeswiki/yeswiki | YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`) | high | 8.3 | 1% |
| CVE-2024-3060 | enl-newsletter (WordPress plugin) | The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admi | medium | 4.5 | 1% |
| CVE-2024-4318 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and includin | high | 8.8 | 1% |
| CVE-2024-3561 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and includ | high | 8.8 | 1% |
| CVE-2024-5329 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘da | high | 8.8 | 1% |
| CVE-2024-6338 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up | high | 8.8 | 1% |
| CVE-2023-35782 | in2code/ipandlanguageredirect | ipandlanguageredirect extension vulnerable to SQL Injection | high | 8.2 | 1% |
| CVE-2026-27461 | pimcore/pimcore | Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause | medium | 0.0 | 1% |
| CVE-2025-51510 | moonshine/moonshine | MoonShine SQL Injection Vulnerability | medium | 4.9 | 1% |
| CVE-2024-7780 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | high | 7.2 | 1% |
| CVE-2024-7112 | booking-system (WordPress plugin) | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter i | high | 8.8 | 1% |
| CVE-2024-9828 | taskbuilder (WordPress plugin) | The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, | medium | 4.1 | 1% |