Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-4064 | landing-pages (WordPress plugin) | SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authentica | medium | 6.5 | 4% |
| CVE-2018-9019 | dolibarr/dolibarr | Dolibarr SQL Injection vulnerability | critical | 9.8 | 4% |
| CVE-2024-8484 | rest-api-to-miniprogram (WordPress plugin) | The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/ | high | 7.5 | 4% |
| CVE-2015-3933 | genix/cms | MetalGenix GeniXCMS vulnerable to SQL Injection | critical | 9.8 | 4% |
| CVE-2022-21664 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanit | high | 7.4 | 4% |
| CVE-2023-0224 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated | critical | 9.8 | 4% |
| CVE-2015-4018 | feedwordpress (WordPress plugin) | SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remo | medium | 6.5 | 4% |
| CVE-2019-13569 | email-subscribers (WordPress plugin) | A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitat | critical | 9.8 | 4% |
| CVE-2007-4894 | WordPress core | Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execu | high | 7.5 | 4% |
| CVE-2017-1002020 | surveys (WordPress plugin) | Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it insid | critical | 9.8 | 4% |
| CVE-2017-1002021 | surveys (WordPress plugin) | Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before plac | critical | 9.8 | 4% |
| CVE-2017-1002022 | surveys (WordPress plugin) | Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside | critical | 9.8 | 4% |
| CVE-2014-8810 | wp-symposium (WordPress plugin) | SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated use | medium | 6.5 | 4% |
| CVE-2014-9305 | cart66-lite (WordPress plugin) | SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordP | medium | 6.5 | 4% |
| CVE-2019-6798 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection in Designer feature | critical | 9.8 | 4% |
| CVE-2014-4944 | bsk-pdf-manager (WordPress plugin) | Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authentic | medium | 6.5 | 4% |
| CVE-2019-11768 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection in Designer feature | critical | 9.8 | 4% |
| CVE-2017-1002012 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snipp | critical | 9.8 | 3% |
| CVE-2017-1002004 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before addin | high | 7.5 | 3% |
| CVE-2015-7564 | nilsteampassnet/teampass | TeamPass vulnerable to SQL Injection | critical | 9.8 | 3% |
| CVE-2024-0566 | smart-manager (WordPress plugin) | The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leadi | high | 7.2 | 3% |
| CVE-2024-6924 | truebooker (WordPress plugin) | The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJ | critical | 9.8 | 3% |
| CVE-2024-6926 | viral-signup (WordPress plugin) | The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an A | critical | 9.8 | 3% |
| CVE-2024-6928 | opti-marketing (WordPress plugin) | The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a | critical | 9.8 | 3% |
| CVE-2014-8375 | gb-gallery-slideshow (WordPress plugin) | SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute ar | medium | 6.5 | 3% |
| CVE-2017-14125 | responsive-image-gallery-gallery-album (WordPress plugin) | SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary S | critical | 9.8 | 3% |
| CVE-2017-1002005 | dtracker (WordPress plugin) | Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before | high | 7.5 | 3% |
| CVE-2013-1400 | wordpress-poll (WordPress plugin) | Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL co | critical | 9.8 | 3% |
| CVE-2015-5599 | powerplay-gallery (WordPress plugin) | Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arb | high | 7.5 | 3% |
| CVE-2020-3719 | magento/community-edition, magento/core | Magento sql injection vulnerability | high | 7.5 | 3% |
| CVE-2024-1207 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in | critical | 9.8 | 3% |
| CVE-2010-4257 | WordPress core | SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated u | medium | 6.0 | 3% |
| CVE-2013-1842 | typo3/cms-core | TYPO3 SQL injection vulnerability in the Extbase Framework | high | 7.4 | 3% |
| CVE-2015-7670 | simple-support-ticket-system (WordPress plugin) | Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote at | critical | 9.8 | 3% |
| CVE-2024-1751 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id para | high | 8.8 | 3% |
| CVE-2023-24788 | notrinos/notrinos-erp | NotrinosERP vulnerable to SQL Injection | high | 8.8 | 3% |
| CVE-2017-14848 | wphrm-human-resource-management-system (WordPress plugin) | WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter. | high | 8.8 | 3% |
| CVE-2024-9796 | wp-advanced-search (WordPress plugin) | The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allo | critical | 9.8 | 3% |
| CVE-2014-8621 | store-locator (WordPress plugin) | SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL comm | critical | 9.8 | 3% |
| CVE-2015-9316 | wp-fastest-cache (WordPress plugin) | The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via t | critical | 9.8 | 3% |
| CVE-2016-7405 | adodb/adodb-php | ADOdb Library SQL Injection | critical | 9.8 | 3% |
| CVE-2017-1002023 | easy-team-manager (WordPress plugin) | Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file | critical | 9.8 | 3% |
| CVE-2011-5286 | social-slider (WordPress plugin) | SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider plugin before 7.4.2 for WordPress allows remote attackers to ex | high | 7.5 | 3% |
| CVE-2014-4938 | wp-rss-poster (WordPress plugin) | SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL | high | 7.5 | 3% |
| CVE-2025-1323 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in a | high | 7.5 | 3% |
| CVE-2017-1002013 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slidesh | critical | 9.8 | 3% |
| CVE-2017-1002014 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php | critical | 9.8 | 3% |
| CVE-2017-1002015 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php | critical | 9.8 | 3% |
| CVE-2024-8911 | latepoint (WordPress plugin) | The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.1 | critical | 9.8 | 3% |
| CVE-2003-1598 | WordPress core | SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the | high | 7.5 | 3% |