Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-50383 | alextselegidis/easyappointments | Easy!Appointments SQL injection vulnerability | medium | 0.0 | 0% |
| CVE-2026-31858 | craftcms/cms | CraftCMS's `ElementSearchController` Affected by Blind SQL Injection | high | 0.0 | 0% |
| CVE-2024-13608 | track-logins (WordPress plugin) | The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins t | medium | 4.7 | 0% |
| CVE-2026-50636 | limesurvey/limesurvey | LimeSurvey has a SQL Injection issue | high | 8.8 | 0% |
| CVE-2026-33651 | wwbn/avideo | AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() | high | 8.1 | 0% |
| CVE-2024-13596 | wp-survey-and-poll (WordPress plugin) | The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' at | medium | 6.5 | 0% |
| CVE-2024-12607 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'mj_smgt_show_e | medium | 6.5 | 0% |
| CVE-2024-13781 | hero-maps-premium (WordPress plugin) | The Hero Maps Premium plugin for WordPress is vulnerable to SQL Injection via several AJAX actions in all versions up to, and including, 2.3 | medium | 6.5 | 0% |
| CVE-2025-13359 | taxopress (WordPress plugin) | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the " | medium | 6.5 | 0% |
| CVE-2026-41143 | yeswiki/yeswiki | YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave() | high | 8.8 | 0% |
| CVE-2024-12109 | product-labels-for-woocommerce-\(sale-badges\) (WordPress plugin) | The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a | medium | 4.1 | 0% |
| CVE-2024-6480 | sip-reviews-shortcode-woocommerce (WordPress plugin) | The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'no_of_reviews' attribut | medium | 6.4 | 0% |
| CVE-2024-9838 | auto-affiliate-links (WordPress plugin) | The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing | medium | 5.4 | 0% |
| CVE-2024-9879 | melapress-file-monitor (WordPress plugin) | The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowi | medium | 5.4 | 0% |
| CVE-2021-47763 | aimeos/aimeos-laravel | Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter | high | 8.2 | 0% |
| CVE-2025-3951 | wp-optimize (WordPress plugin) | The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could all | medium | 4.1 | 0% |
| CVE-2026-3105 | mautic/core | Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting | high | 7.6 | 0% |
| CVE-2026-8827 | friendsoftypo3/tt-address | TYPO3 SQL Injection in extension "Address List" (tt_address) | high | 0.0 | 0% |
| CVE-2024-9770 | wp-recall (WordPress plugin) | The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins | medium | 4.7 | 0% |
| CVE-2025-6739 | wpquiz (WordPress plugin) | The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and i | medium | 6.5 | 0% |
| CVE-2025-13000 | db-access (WordPress plugin) | The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscr | high | 7.7 | 0% |
| CVE-2019-25710 | dolibarr/dolibarr | Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php | high | 8.2 | 0% |
| CVE-2025-60798 | phppgadmin/phppgadmin | phppgadmin contains a SQL injection vulnerability | medium | 6.5 | 0% |
| CVE-2024-13095 | wp-triggers-lite (WordPress plugin) | The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing ad | medium | 4.8 | 0% |
| CVE-2026-32272 | craftcms/commerce | Craft Commerce hasVariant/hasProduct Blind SQL Injection | high | 0.0 | 0% |
| CVE-2015-10146 | wp-responsive-slider-with-lightbox (WordPress plugin) | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and inc | medium | 4.9 | 0% |
| CVE-2015-10147 | easy-testimonial-rotator (WordPress plugin) | The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and i | medium | 4.9 | 0% |
| CVE-2026-32813 | admidio/admidio | Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter) | high | 8.0 | 0% |
| CVE-2025-60797 | phppgadmin/phppgadmin | phppgadmin contains a SQL injection vulnerability | medium | 6.5 | 0% |
| CVE-2026-32593 | winter/wn-backend-module | Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax | medium | 5.9 | 0% |
| CVE-2025-2203 | funnel-builder (WordPress plugin) | The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins t | medium | 6.1 | 0% |
| CVE-2026-46359 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields | high | 7.5 | 0% |
| CVE-2026-56738 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion | high | 0.0 | 0% |
| CVE-2025-9318 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_lin | medium | 6.5 | 0% |
| CVE-2025-13001 | donations (WordPress plugin) | The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privile | medium | 4.1 | 0% |
| CVE-2026-47132 | thorsten/phpmyfaq | phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration | medium | 5.4 | 0% |
| CVE-2026-49741 | typo3/cms-core, typo3/cms-form | TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework | high | 0.0 | 0% |
| CVE-2026-44521 | studio-42/elfinder | elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL) | high | 8.8 | 0% |
| CVE-2026-33723 | wwbn/avideo | AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter | high | 7.1 | 0% |
| CVE-2026-4776 | mautic/core | Mautic has SQL Injection in API Contact Filtering | high | 7.1 | 0% |
| CVE-2026-31825 | sylius/sylius | Sylius has a DQL Injection via API Order Filters | medium | 5.3 | 0% |
| CVE-2026-42474 | mix/mix | MixPHP Framework has an SQL injection vulnerability via crafted `data` array | medium | 6.5 | 0% |
| CVE-2026-42475 | mix/mix | MixPHP Framework has an SQL injection vulnerability | medium | 6.5 | 0% |
| CVE-2026-4079 | sql-chart-builder (WordPress plugin) | The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possib | medium | 6.5 | 0% |
| CVE-2025-2248 | wp-pmanager (WordPress plugin) | The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to | medium | 5.4 | 0% |
| CVE-2026-45262 | facturascripts/facturascripts | FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` | critical | 9.9 | – |
| GHSA-2x36-qhx3-7m5f | zendframework/zendframework1 | ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select | critical | 9.8 | – |
| GHSA-6fqw-j3vm-7f66 | zendframework/zendframework1 | Zendframework1 Potential SQL injection in ORDER and GROUP functions | critical | 9.8 | – |
| GHSA-7g7c-qhf3-x59p | propel/propel1 | propel/propel1 SQL injection possible with limit() on MySQL | critical | 9.8 | – |
| GHSA-7vw7-qx38-37vr | propel/propel | Propel2 SQL injection possible with limit() on MySQL | critical | 9.8 | – |