Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-29174 | craftcms/commerce | Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting | high | 0.0 | 0% |
| CVE-2024-11135 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all ver | high | 7.5 | 0% |
| CVE-2026-28805 | devcode-it/openstamanager | OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter | high | 8.8 | 0% |
| CVE-2024-13236 | tainacan (WordPress plugin) | The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collection_id' parameter in all versions up to, and including, 0.2 | medium | 6.5 | 0% |
| CVE-2024-12410 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and inclu | medium | 4.9 | 0% |
| CVE-2024-52431 | wordpress-video-robot (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressaholic WordPress Video Robot - Th | critical | 9.3 | 0% |
| CVE-2026-45073 | symfony/cache, symfony/symfony | Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix | medium | 0.0 | 0% |
| CVE-2024-3200 | wpforo-forum (WordPress plugin) | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up t | critical | 9.9 | 0% |
| CVE-2024-4743 | lifterlms (WordPress plugin) | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lift | high | 8.8 | 0% |
| CVE-2024-11179 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' par | medium | 6.5 | 0% |
| CVE-2026-42550 | flightphp/core | Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete | high | 8.8 | 0% |
| CVE-2024-4779 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[pos | high | 8.8 | 0% |
| CVE-2024-4845 | email-subscribers (WordPress plugin) | The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all versions up to, and incl | high | 8.8 | 0% |
| CVE-2024-13435 | ebook-downloader (WordPress plugin) | The Ebook Downloader plugin for WordPress is vulnerable to SQL Injection via the 'download' parameter in all versions up to, and including, | high | 7.5 | 0% |
| CVE-2024-13476 | ltl-freight-quotes (WordPress plugin) | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_dropship' AJAX endpo | high | 7.5 | 0% |
| CVE-2024-13532 | small-package-quotes-purolator-edition (WordPress plugin) | The Small Package Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' pa | high | 7.5 | 0% |
| CVE-2024-7702 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | high | 7.2 | 0% |
| CVE-2025-64519 | torrentpier/torrentpier | TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter | high | 8.8 | 0% |
| CVE-2024-7857 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_ | medium | 6.5 | 0% |
| CVE-2024-13230 | super-socializer (WordPress plugin) | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via | medium | 5.3 | 0% |
| CVE-2024-13680 | cp-easy-form-builder (WordPress plugin) | The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortc | medium | 6.5 | 0% |
| CVE-2024-7651 | app-builder (WordPress plugin) | The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-bu | medium | 5.6 | 0% |
| CVE-2024-6723 | ai-engine (WordPress plugin) | The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to | medium | 4.7 | 0% |
| CVE-2019-25222 | wp-responsive-thumbnail-slider (WordPress plugin) | The Thumbnail carousel slider plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and includin | medium | 4.9 | 0% |
| CVE-2026-29172 | craftcms/commerce | Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting | high | 0.0 | 0% |
| CVE-2024-48229 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 0% |
| CVE-2025-1986 | gutentor (WordPress plugin) | The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to | medium | 4.1 | 0% |
| CVE-2025-0959 | eventer (WordPress plugin) | The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all v | high | 8.8 | 0% |
| CVE-2024-4145 | search-\&-replace (WordPress plugin) | The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing adm | high | 7.2 | 0% |
| CVE-2025-69213 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint) | high | 0.0 | 0% |
| CVE-2024-13480 | ltl-freight-quotes-fedex-freight-edition (WordPress plugin) | The LTL Freight Quotes – For Customers of FedEx Freight plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_ | high | 7.5 | 0% |
| CVE-2024-13490 | ltl-freight-quotes (WordPress plugin) | The LTL Freight Quotes – XPO Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters | high | 7.5 | 0% |
| CVE-2024-13531 | shipengine-shipping-quotes (WordPress plugin) | The ShipEngine Shipping Quotes plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and in | high | 7.5 | 0% |
| CVE-2024-12195 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | medium | 6.5 | 0% |
| CVE-2023-2921 | short-url (WordPress plugin) | The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to | high | 8.8 | 0% |
| CVE-2024-12635 | wp-docs (WordPress plugin) | The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, | medium | 6.5 | 0% |
| CVE-2024-10341 | league-of-legends-shortcodes (WordPress plugin) | The League of Legends Shortcodes plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and inclu | medium | 6.5 | 0% |
| CVE-2024-12332 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up | medium | 6.5 | 0% |
| CVE-2026-8726 | georgringer/news | georgringer/news has SQL Injection in extension "News system" (news) | high | 0.0 | 0% |
| CVE-2023-5252 | fareharbor (WordPress plugin) | The FareHarbor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.7 due | medium | 6.4 | 0% |
| CVE-2025-69215 | devcode-it/openstamanager | OpenSTAManager has an SQL Injection in the Stampe Module | high | 0.0 | 0% |
| CVE-2026-5394 | pimcore/pimcore | Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save | high | 0.0 | 0% |
| CVE-2025-62617 | admidio/admidio | Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality | high | 7.2 | 0% |
| CVE-2025-8264 | z-push/z-push-dev | z-push/z-push-dev SQL Injection Vulnerability | critical | 9.0 | 0% |
| CVE-2026-22243 | egroupware/egroupware | EGroupware has SQL Injection in Nextmatch Filter Processing | high | 0.0 | 0% |
| CVE-2026-27697 | baserproject/basercms | baserCMS has an SQL injection vulnerability in its blog post functionality | medium | 0.0 | 0% |
| CVE-2024-13500 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | medium | 6.5 | 0% |
| CVE-2024-13713 | wpexperts-square-for-give (WordPress plugin) | The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and incl | medium | 6.5 | 0% |
| CVE-2025-0866 | legoeso-pdf-manager (WordPress plugin) | The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to | medium | 6.5 | 0% |
| CVE-2026-22242 | coreshop/core-shop | CoreShop Vulnerable to SQL Injection via Admin Reports | medium | 4.9 | 0% |