Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2012-6625 | forumpress (WordPress plugin) | SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attac | high | 7.5 | 5% |
| CVE-2017-9603 | wp-jobs (WordPress plugin) | SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via | high | 8.8 | 5% |
| CVE-2018-5315 | wp-events-calendar (WordPress plugin) | The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php. | critical | 9.8 | 5% |
| CVE-2015-3314 | tune-library (WordPress plugin) | SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5. | high | 8.1 | 5% |
| CVE-2022-4059 | cryptocurrency-widgets-pack (WordPress plugin) | The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement v | critical | 9.8 | 5% |
| CVE-2015-7235 | cp-reservation-calendar (WordPress plugin) | Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote | high | 7.5 | 5% |
| CVE-2013-7187 | formcraft (WordPress plugin) | SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary | high | 7.5 | 5% |
| CVE-2020-28413 | mantisbt/mantisbt | MantisBT SQL Injection via mc_project_get_users function | medium | 5.3 | 5% |
| CVE-2015-3325 | wp-symposium (WordPress plugin) | SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary S | high | 7.5 | 5% |
| CVE-2021-24404 | wp-board (WordPress plugin) | The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised, escaped or validat | high | 8.8 | 5% |
| CVE-2021-43789 | prestashop/prestashop | SQL injection in prestashop/prestashop | high | 7.5 | 5% |
| CVE-2021-24295 | spam-protection\,-antispam\,-firewall (WordPress plugin) | It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by Cle | high | 7.5 | 5% |
| CVE-2021-24401 | wp-domain-redirect (WordPress plugin) | The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an `editid` parameter which is not sanitised, escap | high | 7.2 | 5% |
| CVE-2021-24402 | wp-icommerce (WordPress plugin) | The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or v | high | 7.2 | 5% |
| CVE-2014-9178 | sp-project-\&-document-manager (WordPress plugin) | Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-docum | high | 7.5 | 5% |
| CVE-2019-14230 | onionbuzz (WordPress plugin) | An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set | critical | 9.8 | 5% |
| CVE-2019-14231 | onionbuzz (WordPress plugin) | An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the | critical | 9.8 | 5% |
| CVE-2014-10013 | awp-classifieds (WordPress plugin) | SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQ | high | 7.5 | 5% |
| CVE-2014-5189 | lead-octopus (WordPress plugin) | SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers to execute arbitrar | high | 7.5 | 5% |
| CVE-2014-5201 | gallery-objects (WordPress plugin) | SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via th | high | 7.5 | 5% |
| CVE-2014-9175 | wpdatatables (WordPress plugin) | SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execut | high | 7.5 | 5% |
| CVE-2015-2090 | wp-survey-and-poll (WordPress plugin) | SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows r | high | 7.5 | 5% |
| CVE-2015-2216 | photocrati (WordPress theme) | SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL co | high | 7.5 | 5% |
| CVE-2021-26830 | tribalsystems/zenario | SQL Injection in tribalsystems/zenario | critical | 9.1 | 5% |
| CVE-2019-14313 | photo-gallery (WordPress plugin) | A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerab | critical | 9.8 | 4% |
| CVE-2026-26990 | librenms/librenms | LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php | high | 8.8 | 4% |
| CVE-2022-33965 | wp-stats-manager (WordPress plugin) | Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress. | critical | 9.3 | 4% |
| CVE-2019-13573 | fv-wordpress-flowplayer (WordPress plugin) | A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploi | critical | 9.8 | 4% |
| CVE-2014-5200 | fb-gorilla (WordPress plugin) | SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute arbitrary SQL command | high | 7.5 | 4% |
| CVE-2018-1002000 | bft-autoresponder (WordPress plugin) | There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privile | high | 7.2 | 4% |
| CVE-2013-1408 | wysija-newsletters (WordPress plugin) | Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators | medium | 6.5 | 4% |
| CVE-2022-4093 | dolibarr/dolibarr | SQL injection in Dolibarr | critical | 9.8 | 4% |
| CVE-2022-45808 | learnpress (WordPress plugin) | SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. | critical | 9.9 | 4% |
| CVE-2008-0616 | dmsguestbook (WordPress plugin) | SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administr | medium | 6.5 | 4% |
| CVE-2015-4066 | gigpress (WordPress plugin) | Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated us | medium | 6.5 | 4% |
| CVE-2023-0600 | visitor-statistics (WordPress plugin) | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, | critical | 9.8 | 4% |
| CVE-2014-100003 | yourmembers (WordPress plugin) | SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for WordPress allows remote | high | 7.5 | 4% |
| CVE-2015-7517 | double-opt-in-for-download (WordPress plugin) | Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute | critical | 9.8 | 4% |
| CVE-2022-0439 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `aja | high | 8.8 | 4% |
| CVE-2014-6242 | all-in-one-wp-security-and-firewall (WordPress plugin) | Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated | medium | 6.5 | 4% |
| CVE-2024-3605 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms RE | critical | 10.0 | 4% |
| CVE-2024-6205 | payplus-payment-gateway (WordPress plugin) | The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL stateme | critical | 9.8 | 4% |
| CVE-2022-26986 | impresscms/impresscms | SQL injection in ImpressCMS | high | 7.2 | 4% |
| CVE-2016-4861 | zendframework/zendframework | Zend Framework Allows SQL Injection | critical | 9.8 | 4% |
| CVE-2017-9834 | watupro (WordPress plugin) | SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via | critical | 9.8 | 4% |
| CVE-2022-3481 | woocommerce-dropshipping (WordPress plugin) | The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statemen | critical | 9.8 | 4% |
| CVE-2019-13571 | advanced-cf7-db (WordPress plugin) | A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of th | critical | 9.8 | 4% |
| CVE-2022-3768 | wpsmartcontracts (WordPress plugin) | The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, le | high | 8.8 | 4% |
| CVE-2025-65093 | librenms/librenms | LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint | medium | 5.5 | 4% |
| CVE-2023-3197 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and inclu | critical | 9.8 | 4% |