Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9018 | wp-easy-gallery (WordPress plugin) | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all | high | 8.8 | 1% |
| CVE-2026-44741 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter | high | 8.8 | 0% |
| CVE-2024-48231 | funadmin/funadmin | SQL injection in funadmin | high | 7.2 | 0% |
| CVE-2024-4742 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL | medium | 6.5 | 0% |
| CVE-2026-33770 | wwbn/avideo | AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables | high | 0.0 | 0% |
| CVE-2024-6166 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via th | high | 8.8 | 0% |
| CVE-2024-7717 | wp-events-manager (WordPress plugin) | The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and in | high | 8.8 | 0% |
| CVE-2024-13473 | ltl-freight-quotes-worldwide-express-edition (WordPress plugin) | The LTL Freight Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_ | high | 7.5 | 0% |
| CVE-2025-27617 | pimcore/pimcore | Pimcore Vulnerable to SQL Injection in getRelationFilterCondition | medium | 0.0 | 0% |
| CVE-2025-56421 | limesurvey/limesurvey | LimeSurvey is vulnerable to SQL injection | high | 7.5 | 0% |
| CVE-2024-12615 | passwords-manager (WordPress plugin) | The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX actions in all version | medium | 6.5 | 0% |
| CVE-2019-25212 | wp-responsive-video-gallery-with-lightbox (WordPress plugin) | The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, an | medium | 4.9 | 0% |
| CVE-2024-4902 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ para | high | 7.2 | 0% |
| CVE-2024-5207 | post-smtp (WordPress plugin) | The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerab | high | 7.2 | 0% |
| CVE-2025-1321 | teachpress (WordPress plugin) | The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up | medium | 6.5 | 0% |
| CVE-2024-6479 | sip-reviews-shortcode-woocommerce (WordPress plugin) | The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'no_of_reviews' attribute in the wooco | medium | 6.5 | 0% |
| CVE-2026-77635 | cakephp/cakephp, cakephp/database | CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver | critical | 0.0 | 0% |
| CVE-2026-22850 | koko-analytics (WordPress plugin) | Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through u | high | 8.3 | 0% |
| CVE-2024-13426 | wp-polls (WordPress plugin) | The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient | medium | 5.4 | 0% |
| CVE-2024-13369 | tour-master (WordPress plugin) | The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter i | medium | 6.5 | 0% |
| CVE-2024-48230 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 0% |
| CVE-2021-4450 | post-grid (WordPress plugin) | The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to in | high | 8.8 | 0% |
| CVE-2024-2871 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-5325 | form-vibes (WordPress plugin) | The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fv_export_data’ parameter in all versions up to, and including, | high | 8.8 | 0% |
| CVE-2024-3592 | quiz-master-next (WordPress plugin) | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'qu | critical | 9.9 | 0% |
| CVE-2024-8436 | wp-easy-gallery (WordPress plugin) | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'edit_imageId' and 'edit_imageDel | critical | 9.9 | 0% |
| CVE-2026-52775 | yeswiki/yeswiki | YesWiki has Authenticated SQL Injection via ReactionManager | high | 8.8 | 0% |
| CVE-2024-8624 | wp-meta-data-filter-and-taxonomy-filter (WordPress plugin) | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_sele | critical | 9.9 | 0% |
| CVE-2026-28562 | wpforo (WordPress plugin) | wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffectiv | high | 8.2 | 0% |
| CVE-2024-9475 | poll-maker (WordPress plugin) | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by par | medium | 4.9 | 0% |
| CVE-2023-47438 | reportico-web/reportico | SQL Injection vulnerability in Reportico Till | medium | 6.5 | 0% |
| CVE-2024-13341 | multiloca (WordPress plugin) | The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via the 'data-id' param | medium | 6.5 | 0% |
| CVE-2025-25226 | joomla/database | Joomla Framework Database Package Vulnerable to SQL Injection | medium | 0.0 | 0% |
| CVE-2023-52135 | ws-form (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE – Drag & Drop Con | high | 7.6 | 0% |
| CVE-2024-13234 | woo-product-tables (WordPress plugin) | The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, | high | 7.5 | 0% |
| CVE-2019-25221 | responsive-filterable-portfolio (WordPress plugin) | The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and in | medium | 6.5 | 0% |
| CVE-2024-13475 | small-package-quotes (WordPress plugin) | The Small Package Quotes – UPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to | high | 7.5 | 0% |
| CVE-2026-33485 | wwbn/avideo | AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter | high | 7.5 | 0% |
| CVE-2019-25218 | wp-responsive-photo-gallery (WordPress plugin) | The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versio | medium | 4.9 | 0% |
| CVE-2026-32271 | craftcms/commerce | Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget | high | 0.0 | 0% |
| CVE-2020-36947 | librenms/librenms | LibreNMS contains an authenticated SQL Injection vulnerability | high | 7.1 | 0% |
| CVE-2024-13321 | analyticswp (WordPress plugin) | The AnalyticsWP plugin for WordPress is vulnerable to SQL Injection via the 'custom_sql' parameter in all versions up to, and including, 2.0 | high | 7.5 | 0% |
| CVE-2024-13491 | small-package-quotes-fedex-edition (WordPress plugin) | The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_i | high | 7.5 | 0% |
| CVE-2024-13534 | small-package-quotes-wwe-edition (WordPress plugin) | The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edi | high | 7.5 | 0% |
| CVE-2025-69214 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint) | high | 8.8 | 0% |
| CVE-2026-23492 | pimcore/pimcore | Pimcore Has an Incomplete Patch for CVE-2023-30848 | high | 8.8 | 0% |
| CVE-2026-52770 | yeswiki/yeswiki | YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters | high | 7.5 | 0% |
| CVE-2024-11710 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via t | medium | 4.9 | 0% |
| CVE-2024-11713 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via t | medium | 4.9 | 0% |
| CVE-2024-11714 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via t | medium | 4.9 | 0% |