Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-10017 | e-commerce (WordPress plugin) | Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL | high | 7.5 | 2% |
| CVE-2024-8625 | ts-poll (WordPress plugin) | The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to p | high | 7.2 | 2% |
| CVE-2019-7726 | nukeviet/nukeviet | SQL Injection in NukeViet | critical | 9.8 | 2% |
| CVE-2014-5180 | hdw-player-video-player-video-gallery (WordPress plugin) | SQL injection vulnerability in the videos page in the HDW Player Plugin (hdw-player-video-player-video-gallery) 2.4.2 for WordPress allows r | medium | 6.5 | 2% |
| CVE-2017-13137 | formcraft (WordPress plugin) | The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php. | critical | 9.8 | 2% |
| CVE-2020-24400 | magento/community-edition | Magento SQL Injection vulnerability | high | 7.1 | 2% |
| CVE-2014-4939 | enl-newsletter (WordPress plugin) | SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to | medium | 6.5 | 2% |
| CVE-2014-7153 | image-gallery (WordPress plugin) | SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress al | medium | 6.5 | 2% |
| CVE-2017-1002009 | membership-simplified (WordPress plugin) | Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulner | critical | 9.8 | 2% |
| CVE-2017-1002010 | membership-simplified (WordPress plugin) | Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulner | critical | 9.8 | 2% |
| CVE-2024-9186 | funnelkit-automations (WordPress plugin) | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does | high | 8.6 | 2% |
| CVE-2014-5182 | yawpp (WordPress plugin) | Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to | medium | 6.0 | 2% |
| CVE-2019-15646 | rsvpmaker (WordPress plugin) | The rsvpmaker plugin before 6.2 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2018-16809 | dolibarr/dolibarr | Dolibarr SQL injection via the integer parameters qty and value_unit | critical | 9.8 | 2% |
| CVE-2021-24959 | wp-email-users (WordPress plugin) | The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available | high | 8.8 | 2% |
| CVE-2018-21004 | rsvpmaker (WordPress plugin) | The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2012-5853 | cardoza-ajax-search (WordPress plugin) | SQL injection vulnerability in the "the_search_function" function in cardoza_ajax_search.php in the AJAX Post Search (cardoza-ajax-search) p | high | 7.5 | 2% |
| CVE-2019-18622 | phpmyadmin/phpmyadmin | SQL injection in phpMyAdmin | critical | 9.8 | 2% |
| CVE-2020-15873 | librenms/librenms | LibreNMS SQL Injection vulnerability | medium | 6.5 | 2% |
| CVE-2015-4615 | easy2map-photos (WordPress plugin) | Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, paren | critical | 9.8 | 2% |
| CVE-2019-15872 | loginpress (WordPress plugin) | The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings. | critical | 9.8 | 2% |
| CVE-2018-19998 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in user/card.php | high | 8.8 | 2% |
| CVE-2015-5308 | wp-championship (WordPress plugin) | Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execu | high | 7.5 | 2% |
| CVE-2023-5203 | wp-sessions-time-monitoring-full-automatic (WordPress plugin) | The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before us | high | 7.5 | 2% |
| CVE-2019-13413 | rencontre (WordPress plugin) | The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php. | critical | 9.8 | 2% |
| CVE-2018-18018 | slideshow-gallery (WordPress plugin) | SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&metho | critical | 9.8 | 2% |
| CVE-2024-13496 | gamipress (WordPress plugin) | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-b | high | 7.5 | 2% |
| CVE-2015-9450 | plugmatter-optin-feature-box-lite (WordPress plugin) | The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pm | critical | 9.8 | 2% |
| CVE-2019-13572 | blog2social (WordPress plugin) | The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. | critical | 9.8 | 2% |
| CVE-2015-9496 | freshmail-newsletter (WordPress plugin) | The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring. | high | 8.8 | 2% |
| CVE-2014-2316 | search-everything (WordPress plugin) | SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execu | high | 7.5 | 2% |
| CVE-2012-6144 | typo3/cms | Typo3 Backend History Module Vulnerable to SQL Injection | medium | 0.0 | 2% |
| CVE-2018-16385 | topthink/framework | ThinkPHP SQL Injection vulnerability | critical | 9.8 | 2% |
| CVE-2014-8363 | wordpress-spreadsheet (WordPress plugin) | SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execu | high | 7.5 | 2% |
| CVE-2018-11309 | membermouse (WordPress plugin) | Blind SQL injection in coupon_code in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the Wo | critical | 9.8 | 2% |
| CVE-2016-11000 | wp-ultimate-exporter (WordPress plugin) | The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter. | critical | 9.8 | 2% |
| CVE-2015-1055 | photo-gallery (WordPress plugin) | SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via th | high | 7.5 | 2% |
| CVE-2018-19271 | centreon/centreon | Centreon SQL Injection | high | 8.8 | 2% |
| CVE-2013-3478 | video-gallery-plugin (WordPress plugin) | SQL injection vulnerability in Apptha WordPress Video Gallery 2.0, 1.6, and earlier for WordPress allows remote attackers to execute arbitra | high | 7.5 | 2% |
| CVE-2021-36880 | ulisting (WordPress plugin) | Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom. | high | 8.6 | 2% |
| CVE-2014-7959 | bulletproof-security (WordPress plugin) | SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote auth | medium | 6.5 | 2% |
| CVE-2019-19209 | dolibarr/dolibarr | Dolibarr ERP and CRM SQLi | high | 7.5 | 2% |
| CVE-2015-9334 | email-newsletter (WordPress plugin) | The email-newsletter plugin through 20.15 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2018-1000131 | wp-support-plus-responsive-ticket-system (WordPress plugin) | Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the funct | critical | 9.8 | 2% |
| CVE-2016-6233 | zendframework/zendframework, zendframework/zendframework1 | Zend Framework Allows SQL Injection | critical | 9.8 | 2% |
| CVE-2024-43965 | sendgrid (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress all | high | 8.2 | 2% |
| CVE-2020-24315 | cardoza-wordpress-poll (WordPress plugin) | Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input | high | 7.5 | 2% |
| CVE-2018-19994 | dolibarr/dolibarr | Dolibarr error-based SQL injection vulnerability in product/card.php | high | 8.8 | 2% |
| CVE-2014-3937 | contextual-related-posts (WordPress plugin) | SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrar | high | 7.5 | 2% |
| CVE-2022-0254 | bmarshall511/wordpress_zero_spam, zero-spam (WordPress plugin) | SQL Injection in WordPress Zero Spam WordPress plugin | critical | 9.8 | 2% |