Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-13578 | givewp (WordPress plugin) | A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerab | critical | 9.8 | 3% |
| CVE-2016-0769 | eshop-plugin (WordPress plugin) | Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execu | high | 8.8 | 3% |
| CVE-2015-7695 | zendframework/zendframework1 | Zend Framework SQL injection vector using null byte for PDO | critical | 9.8 | 3% |
| CVE-2024-0399 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL st | high | 8.1 | 3% |
| CVE-2017-15919 | ultimate-form-builder-lite (WordPress plugin) | The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin- | critical | 9.8 | 3% |
| CVE-2024-6159 | push-notification-for-post-and-buddypress (WordPress plugin) | The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using i | critical | 9.8 | 3% |
| CVE-2021-21024 | magento/community-edition | Magento Blind SQL Injection in the Search module | critical | 9.1 | 3% |
| CVE-2017-9429 | event-list (WordPress plugin) | SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via | high | 8.8 | 3% |
| CVE-2019-14695 | popup-builder (WordPress plugin) | A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerab | critical | 9.8 | 3% |
| CVE-2017-14842 | smsmaster-multipurpose-sms-gateway (WordPress plugin) | Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14843 | school-management-system (WordPress plugin) | Mojoomla School Management System for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14844 | wpgym-gym-management-system (WordPress plugin) | Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14845 | wpchurch-church-management-system (WordPress plugin) | Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14846 | hospital-management-system (WordPress plugin) | Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2017-14847 | wpams-apartment-management-system (WordPress plugin) | Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter. | high | 8.8 | 3% |
| CVE-2018-14502 | chained-quiz (WordPress plugin) | controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrar | critical | 9.8 | 3% |
| CVE-2015-1000003 | filedownload (WordPress plugin) | Blind SQL Injection in filedownload v1.4 wordpress plugin | critical | 9.8 | 3% |
| CVE-2015-1000011 | dukapress (WordPress plugin) | Blind SQL Injection in wordpress plugin dukapress v2.5.9 | critical | 9.8 | 3% |
| CVE-2024-5522 | html5-video-player (WordPress plugin) | The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL s | medium | 6.5 | 3% |
| CVE-2024-0705 | payment-gateway-stripe-and-woocommerce-integration (WordPress plugin) | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, | critical | 9.8 | 3% |
| CVE-2019-13275 | wp-statistics (WordPress plugin) | An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-def | critical | 9.8 | 3% |
| CVE-2021-24132 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plug | high | 8.8 | 3% |
| CVE-2019-13575 | everest-forms (WordPress plugin) | A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerab | critical | 9.8 | 3% |
| CVE-2017-1002027 | rk-responsive-contact-form (WordPress plugin) | Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query | critical | 9.8 | 3% |
| CVE-2014-8089 | zendframework/zend-db, zendframework/zendframework, zendframework/zendframework1 | Zend Framework SQL injection vulnerability | critical | 9.8 | 3% |
| CVE-2017-18515 | wp-statistics (WordPress plugin) | The wp-statistics plugin before 12.0.8 for WordPress has SQL injection. | critical | 9.8 | 3% |
| CVE-2015-2199 | audio-player (WordPress plugin) | Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users | medium | 6.5 | 3% |
| CVE-2013-6243 | landing-pages (WordPress plugin) | SQL injection vulnerability in the Landing Pages plugin 1.2.3, before 20131009, and earlier for WordPress allows remote attackers to execute | high | 7.5 | 2% |
| CVE-2017-1002018 | eventr (WordPress plugin) | Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL | critical | 9.8 | 2% |
| CVE-2017-1002019 | eventr (WordPress plugin) | Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL | critical | 9.8 | 2% |
| CVE-2022-44588 | cryptocurrency-widgets-pack (WordPress plugin) | Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress. | critical | 9.9 | 2% |
| CVE-2021-43608 | doctrine/dbal | DBAL 3 SQL Injection Security Vulnerability | critical | 9.8 | 2% |
| CVE-2015-2062 | huge-it-slider (WordPress plugin) | Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to | high | 7.2 | 2% |
| CVE-2015-7319 | appointment-booking-calendar (WordPress plugin) | SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 fo | high | 7.5 | 2% |
| CVE-2015-9446 | unite-gallery-lite (WordPress plugin) | The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php. | high | 8.8 | 2% |
| CVE-2016-11018 | gallery-images (WordPress plugin) | An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone | critical | 9.8 | 2% |
| CVE-2015-9466 | wti-like-post (WordPress plugin) | The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, H | critical | 9.8 | 2% |
| CVE-2015-9467 | broken-link-manager (WordPress plugin) | The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter. | critical | 9.8 | 2% |
| CVE-2017-9418 | testimonials-plugin-easy-testimonials (WordPress plugin) | SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands | high | 8.8 | 2% |
| CVE-2024-6265 | userswp (WordPress plugin) | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnera | critical | 9.8 | 2% |
| CVE-2015-9451 | plugmatter-optin-feature-box-lite (WordPress plugin) | The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailc | critical | 9.8 | 2% |
| CVE-2015-9452 | nex-forms-express-wp-form-builder (WordPress plugin) | The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex | critical | 9.8 | 2% |
| CVE-2020-10804 | phpmyadmin/phpmyadmin | phpMyAdmin SQL Injection | high | 8.0 | 2% |
| CVE-2015-6829 | wp-limit-login-attempts (WordPress plugin) | Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0 | high | 7.5 | 2% |
| CVE-2019-12516 | slickquiz (WordPress plugin) | The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=s | high | 8.8 | 2% |
| CVE-2015-4109 | users-ultra (WordPress plugin) | Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to | high | 7.5 | 2% |
| CVE-2023-23490 | survey-maker (WordPress plugin) | The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' paramet | high | 8.8 | 2% |
| CVE-2020-35700 | librenms/librenms | SQL Injection in librenms | high | 8.8 | 2% |
| CVE-2014-100022 | mtouch-quiz (WordPress plugin) | SQL injection vulnerability in question.php in the mTouch Quiz before 3.0.7 for WordPress allows remote attackers to execute arbitrary SQL c | high | 7.5 | 2% |
| CVE-2011-5308 | cdnvote (WordPress plugin) | Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execut | high | 7.5 | 2% |