Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-1446 | pods (WordPress plugin) | The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to pe | critical | 9.8 | 0% |
| CVE-2025-59397 | open-web-analytics/open-web-analytics | Open Web Analytics Server is vulnerable to SQL Injection | medium | 5.0 | 0% |
| CVE-2024-3265 | advance-search (WordPress plugin) | The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for user | medium | 4.7 | 0% |
| CVE-2024-12276 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | 0% |
| CVE-2024-10009 | melapress-file-monitor (WordPress plugin) | The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowi | medium | 4.1 | 0% |
| CVE-2026-92692 | sulu/sulu | Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) | medium | 0.0 | 0% |
| CVE-2024-10638 | product-labels-for-woocommerce-\(sale-badges\) (WordPress plugin) | The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in | medium | 4.1 | 0% |
| CVE-2026-35470 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals | high | 8.8 | 0% |
| CVE-2023-6373 | artplacer-widget (WordPress plugin) | The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to | high | 8.8 | 0% |
| CVE-2024-11730 | kivicare-clinic-management-system (WordPress plugin) | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of th | medium | 6.5 | 0% |
| CVE-2026-55208 | pimcore/studio-backend-bundle | Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password h | high | 7.7 | 0% |
| CVE-2024-13344 | advance-seat-reservation-management-for-woocommerce (WordPress plugin) | The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in | high | 7.5 | 0% |
| CVE-2025-4204 | ultimate-wordpress-auction-plugin (WordPress plugin) | The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2025-10351 | melisplatform/melis-cms | Melis Platform CMS SQL Injection | critical | 0.0 | 0% |
| CVE-2026-24416 | devcode-it/openstamanager | OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module | high | 0.0 | 0% |
| CVE-2026-24417 | devcode-it/openstamanager | OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service | high | 0.0 | 0% |
| CVE-2025-6783 | gozen-forms (WordPress plugin) | The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions u | high | 7.5 | 0% |
| CVE-2023-6981 | wp-sms (WordPress plugin) | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection | medium | 6.1 | 0% |
| CVE-2024-13594 | simple-downloads-list (WordPress plugin) | The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofix_sdl' shortcode in | medium | 6.5 | 0% |
| CVE-2026-55072 | pimcore/pimcore | Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name | high | 8.5 | 0% |
| CVE-2025-3428 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'coating_text' parameter in all versions up to, and including, | medium | 4.9 | 0% |
| CVE-2025-3429 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'material_text' parameter in all versions up to, and including, | medium | 4.9 | 0% |
| CVE-2025-3430 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'printer_text' parameter in all versions up to, and including, | medium | 4.9 | 0% |
| CVE-2026-24418 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module | high | 0.0 | 0% |
| CVE-2026-31891 | cockpit-hq/cockpit | Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() | high | 7.7 | 0% |
| CVE-2021-4458 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_p | medium | 5.9 | 0% |
| CVE-2025-3427 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'infill_text' parameter in all versions up to, and including, 2 | medium | 4.9 | 0% |
| CVE-2024-13844 | post-smtp (WordPress plugin) | The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, | medium | 4.9 | 0% |
| CVE-2025-69216 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection in Scadenzario Print Template | high | 0.0 | 0% |
| CVE-2024-13846 | ultimate-learning-pro (WordPress plugin) | The Indeed Ultimate Learning Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions | medium | 4.9 | 0% |
| CVE-2025-6782 | gozen-forms (WordPress plugin) | The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all ve | high | 7.5 | 0% |
| CVE-2024-12614 | passwords-manager (WordPress plugin) | The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_ | high | 7.5 | 0% |
| CVE-2026-44739 | pimcore/pimcore | Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration | high | 8.7 | 0% |
| CVE-2024-9156 | ti-woocommerce-wishlist (WordPress plugin) | The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied | high | 7.5 | 0% |
| CVE-2024-13235 | booking-system (WordPress plugin) | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter i | medium | 6.5 | 0% |
| CVE-2024-13595 | simple-signup-form (WordPress plugin) | The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up | medium | 6.5 | 0% |
| CVE-2025-0723 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the ri | medium | 6.5 | 0% |
| CVE-2024-12609 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'view-attendance' page in all version | medium | 6.5 | 0% |
| CVE-2026-24419 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection in the Prima Nota module | high | 0.0 | 0% |
| CVE-2024-13440 | super-store-finder (WordPress plugin) | The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all versions up to, and i | high | 8.2 | 0% |
| CVE-2025-1669 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions | medium | 6.5 | 0% |
| CVE-2025-1670 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up | medium | 6.5 | 0% |
| CVE-2025-5103 | woo-gift-cards-lite (WordPress plugin) | The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'default_price' and 'produ | medium | 4.9 | 0% |
| CVE-2026-52763 | yeswiki/yeswiki | YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read | medium | 6.5 | 0% |
| CVE-2025-4964 | wp-online-users-stats (WordPress plugin) | The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘table_name’ parameter in all versions up t | medium | 4.9 | 0% |
| CVE-2025-4381 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable | high | 7.5 | 0% |
| CVE-2025-5339 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa | high | 7.5 | 0% |
| CVE-2025-6437 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter | high | 7.5 | 0% |
| CVE-2025-65103 | devcode-it/openstamanager | OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter | high | 8.8 | 0% |
| CVE-2026-31069 | billabear/billabear | BillaBear is Vulnerable to SQL Injection in the EventRepository | high | 8.8 | 0% |