Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0814 | ubigeo-de-peru-para-woocommerce (WordPress plugin) | The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in | critical | 9.8 | 8% |
| CVE-2023-5204 | chatbot (WordPress plugin) | The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insu | critical | 9.8 | 8% |
| CVE-2022-0788 | fundengine (WordPress plugin) | The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it | critical | 9.8 | 8% |
| CVE-2022-0949 | block-and-stop-bad-bots (WordPress plugin) | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise | critical | 9.8 | 8% |
| CVE-2022-0658 | commonsbooking (WordPress plugin) | The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (avail | critical | 9.8 | 8% |
| CVE-2022-0787 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL | critical | 9.8 | 8% |
| CVE-2022-1013 | personal-dictionary (WordPress plugin) | The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in | critical | 9.8 | 7% |
| CVE-2021-24943 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregiste | critical | 9.8 | 7% |
| CVE-2020-5766 | srs-simple-hits-counter (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 a | high | 7.5 | 7% |
| CVE-2007-1897 | WordPress core | SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute ar | medium | 6.5 | 7% |
| CVE-2015-5533 | count-per-day (WordPress plugin) | SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated admini | high | 7.2 | 7% |
| CVE-2023-2636 | an-gradebook (WordPress plugin) | The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leadin | high | 8.8 | 7% |
| CVE-2022-1453 | rsvpmaker (WordPress plugin) | The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user s | critical | 9.8 | 7% |
| CVE-2022-0693 | master-elements (WordPress plugin) | The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX | critical | 9.8 | 7% |
| CVE-2015-2314 | wpml (WordPress plugin) | SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the | high | 7.5 | 7% |
| CVE-2022-31181 | prestashop/prestashop | PrestaShop eval injection possible if shop vulnerable to SQL injection | critical | 9.8 | 7% |
| CVE-2017-16510 | WordPress core | WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL inje | critical | 9.8 | 7% |
| CVE-2021-24554 | paytm-pay (WordPress plugin) | The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a S | high | 7.2 | 7% |
| CVE-2022-3254 | awp-classifieds (WordPress plugin) | The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQ | critical | 9.8 | 7% |
| CVE-2017-14723 | WordPress core | Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly addre | critical | 9.8 | 7% |
| CVE-2021-24627 | g-auto-hyperlink (WordPress plugin) | The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to | high | 7.2 | 6% |
| CVE-2021-24731 | pie-register (WordPress plugin) | The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7. | critical | 9.8 | 6% |
| CVE-2015-2824 | simple-ads-manager (WordPress plugin) | Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitr | high | 7.5 | 6% |
| CVE-2019-10866 | form-maker (WordPress plugin) | In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the fi | critical | 9.8 | 6% |
| CVE-2019-10910 | symfony/dependency-injection, symfony/proxy-manager-bridge, symfony/symfony | Symfony Service IDs Allow Injection | critical | 9.8 | 6% |
| CVE-2020-15363 | nexos (WordPress theme) | The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection. | critical | 9.8 | 6% |
| CVE-2022-1950 | youzify (WordPress plugin) | The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action ava | critical | 9.8 | 6% |
| CVE-2017-6095 | mail-masta (WordPress plugin) | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Una | critical | 9.8 | 6% |
| CVE-2014-3961 | participants-database (WordPress plugin) | SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers | high | 7.5 | 6% |
| CVE-2015-2292 | wordpress-seo (WordPress plugin) | Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x be | medium | 6.5 | 6% |
| CVE-2021-24741 | support-board---chat-and-help-desk (WordPress plugin) | The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversa | critical | 9.8 | 6% |
| CVE-2016-10940 | zm-gallery (WordPress plugin) | The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter. | high | 7.2 | 6% |
| CVE-2008-0491 | fgallery (WordPress plugin) | SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL comma | high | 7.5 | 6% |
| CVE-2021-24139 | photo-gallery (WordPress plugin) | Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the fronte | critical | 9.8 | 6% |
| CVE-2022-1339 | pimcore/pimcore | SQL Injection in Pimcore | high | 7.5 | 6% |
| CVE-2016-1000217 | zotpress (WordPress plugin) | Zotpress plugin for WordPress SQLi in zp_get_account() | critical | 9.8 | 6% |
| CVE-2013-1852 | leaguemanager (WordPress plugin) | SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute a | high | 7.5 | 5% |
| CVE-2017-14507 | content-timeline (WordPress plugin) | Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL co | critical | 9.8 | 5% |
| CVE-2022-0228 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in | high | 7.2 | 5% |
| CVE-2017-6096 | mail-masta (WordPress plugin) | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Req | high | 7.2 | 5% |
| CVE-2017-6097 | mail-masta (WordPress plugin) | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.p | high | 7.2 | 5% |
| CVE-2015-4614 | easy2map (WordPress plugin) | Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to | high | 7.5 | 5% |
| CVE-2021-24791 | header-footer-code-manager (WordPress plugin) | The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters befo | high | 7.2 | 5% |
| CVE-2022-3141 | translatepress (WordPress plugin) | The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (vi | high | 8.8 | 5% |
| CVE-2017-6098 | mail-masta (WordPress plugin) | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requi | high | 7.2 | 5% |
| CVE-2023-0630 | slimstat-analytics (WordPress plugin) | The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes d | high | 8.8 | 5% |
| CVE-2018-10969 | pie-register (WordPress plugin) | SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands | critical | 9.8 | 5% |
| CVE-2014-9173 | google-document-embedder (WordPress plugin) | SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arb | high | 7.5 | 5% |
| CVE-2014-9097 | contus-video-gallery (WordPress plugin) | Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed befo | high | 7.5 | 5% |
| CVE-2013-1401 | wordpress-poll (WordPress plugin) | Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 | critical | 9.8 | 5% |