Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3142 | nex-forms (WordPress plugin) | The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to S | high | 8.8 | 15% |
| CVE-2017-2641 | moodle/moodle | Moodle SQL injection via user preferences | critical | 9.8 | 15% |
| CVE-2023-6620 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL stateme | high | 7.2 | 14% |
| CVE-2024-11728 | kivicare-clinic-management-system (WordPress plugin) | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' | high | 7.5 | 14% |
| CVE-2022-0867 | pricing-table (WordPress plugin) | The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolate | critical | 9.8 | 13% |
| CVE-2022-0786 | kivicare (WordPress plugin) | The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_pos | critical | 9.8 | 13% |
| CVE-2022-2840 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements | critical | 9.8 | 13% |
| CVE-2022-0781 | nirweb-support (WordPress plugin) | The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX act | critical | 9.8 | 13% |
| CVE-2025-27892 | shopware/core, shopware/platform | Shopware Vulnerable to Blind SQL-injection in DAL aggregations | high | 7.3 | 13% |
| CVE-2022-1768 | rsvpmaker (WordPress plugin) | The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user | critical | 9.8 | 13% |
| CVE-2020-13640 | wpdiscuz (WordPress plugin) | A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL comma | critical | 9.8 | 13% |
| CVE-2021-24827 | asgaros-forum (WordPress plugin) | The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a S | critical | 9.8 | 13% |
| CVE-2020-26248 | prestashop/productcomments | Blind SQL injection in PrestaShop productcomments module | high | 8.2 | 12% |
| CVE-2024-8529 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1 | critical | 10.0 | 12% |
| CVE-2021-24915 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name | critical | 9.8 | 12% |
| CVE-2021-42325 | froxlor/froxlor | Froxlor SQL injection vulnerability | critical | 9.8 | 12% |
| CVE-2024-6028 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and i | critical | 9.8 | 12% |
| CVE-2022-0817 | badgeos (WordPress plugin) | The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, l | critical | 9.8 | 12% |
| CVE-2023-23489 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in th | critical | 9.8 | 11% |
| CVE-2024-1061 | html5-video-player (WordPress plugin) | The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parame | high | 8.6 | 11% |
| CVE-2021-24507 | astra (WordPress plugin) | The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_ | critical | 9.8 | 11% |
| CVE-2024-6497 | squirrly-seo (WordPress plugin) | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up | high | 8.8 | 11% |
| CVE-2015-2196 | spider-calendar (WordPress plugin) | SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the c | high | 7.5 | 11% |
| CVE-2023-5674 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading | high | 8.8 | 11% |
| CVE-2022-0760 | simple-link-directory (WordPress plugin) | The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statemen | critical | 9.8 | 11% |
| CVE-2022-1692 | cp-image-store-with-slideshow (WordPress plugin) | The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using i | critical | 9.8 | 10% |
| CVE-2024-4443 | business-directory-plugin (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via th | critical | 9.8 | 10% |
| CVE-2017-5611 | WordPress core | SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbit | critical | 9.8 | 10% |
| CVE-2022-0592 | mapsvg (WordPress plugin) | The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, l | critical | 9.8 | 10% |
| CVE-2024-4295 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, | critical | 9.8 | 10% |
| CVE-2022-0784 | title-experiments-free (WordPress plugin) | The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement vi | critical | 9.8 | 10% |
| CVE-2022-0948 | order-listener-for-woocommerce (WordPress plugin) | The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL stat | critical | 9.8 | 10% |
| CVE-2020-27481 | good-learning-management-system (WordPress plugin) | An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPr | critical | 9.8 | 10% |
| CVE-2015-2213 | WordPress core | SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attacke | high | 7.5 | 10% |
| CVE-2021-43408 | copy-delete-posts (WordPress plugin) | The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur | medium | 6.5 | 10% |
| CVE-2015-4062 | newstatpress (WordPress plugin) | SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated use | medium | 6.5 | 9% |
| CVE-2007-6318 | WordPress core | SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL command | medium | 6.8 | 9% |
| CVE-2022-0826 | wp-video-gallery-free (WordPress plugin) | The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX | critical | 9.8 | 9% |
| CVE-2022-0827 | bestbooks (WordPress plugin) | The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX a | critical | 9.8 | 9% |
| CVE-2022-0785 | daily-prayer-time (WordPress plugin) | The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement | critical | 9.8 | 9% |
| CVE-2021-24666 | podlove-podcast-publisher (WordPress plugin) | The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds th | critical | 9.8 | 9% |
| CVE-2022-0846 | speakout\!-email-petitions (WordPress plugin) | The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL state | critical | 9.8 | 9% |
| CVE-2020-9006 | popup-builder (WordPress plugin) | The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax | critical | 9.8 | 9% |
| CVE-2026-26988 | librenms/librenms | LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream. | high | 0.0 | 8% |
| CVE-2021-24849 | frontend-manager-for-woocommerce-along-with-bookings-subscription-listings-compatible (WordPress plugin) | The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated | critical | 9.8 | 8% |
| CVE-2023-1545 | nilsteampassnet/teampass | Teampass SQL Injection vulnerability | high | 7.5 | 8% |
| CVE-2015-3313 | community-events (WordPress plugin) | SQL injection vulnerability in WordPress Community Events plugin before 1.4. | critical | 9.8 | 8% |
| CVE-2022-0769 | users-ultra (WordPress plugin) | The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolat | critical | 9.8 | 8% |
| CVE-2021-39165 | cachethq/cachet | Unauthenticated SQL Injection in Cachet | high | 8.1 | 8% |
| CVE-2022-1057 | pricing-deals-for-woocommerce (WordPress plugin) | The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a S | critical | 9.8 | 8% |