Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-1002028 | wordpress-gallery-transformation (WordPress plugin) | Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php | critical | 9.8 | 2% |
| CVE-2015-9234 | cp-contact-form-with-paypal (WordPress plugin) | The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactform | high | 7.2 | 2% |
| CVE-2017-18614 | kama-clic-counter (WordPress plugin) | The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter. | high | 8.1 | 2% |
| CVE-2017-16955 | inlinks (WordPress plugin) | SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via | high | 8.8 | 2% |
| CVE-2026-46670 | yeswiki/yeswiki | YesWiki: Unauthenticated SQL Injection | critical | 9.8 | 2% |
| CVE-2011-4292 | moodle/moodle | Moodle allows remote authenticated users to cause a denial of service (invalid database records) | medium | 0.0 | 2% |
| CVE-2024-13726 | themes-coder (WordPress plugin) | The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX | high | 8.6 | 2% |
| CVE-2016-10942 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via | critical | 9.8 | 2% |
| CVE-2022-0224 | dolibarr/dolibarr | SQL Injection in dolibarr | high | 8.3 | 2% |
| CVE-2020-5768 | email-subscribers-\&-newsletters (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for W | medium | 4.9 | 2% |
| CVE-2024-5975 | cz-loan-management (WordPress plugin) | The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via | critical | 9.1 | 2% |
| CVE-2015-9324 | easy-digital-downloads (WordPress plugin) | The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2021-24314 | goto (WordPress plugin) | The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in | critical | 9.8 | 2% |
| CVE-2015-9398 | gocodes (WordPress plugin) | The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection. | high | 8.8 | 2% |
| CVE-2015-9400 | wordpress-meta-robots (WordPress plugin) | The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection. | high | 8.8 | 2% |
| CVE-2015-9465 | yet-another-stars-rating (WordPress plugin) | The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id paramete | high | 8.8 | 2% |
| CVE-2016-10950 | sirv (WordPress plugin) | The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter. | high | 8.8 | 2% |
| CVE-2014-5185 | quartz-plugin (WordPress plugin) | SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execu | medium | 6.0 | 2% |
| CVE-2018-13447 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in product/card.php | critical | 9.8 | 2% |
| CVE-2018-19312 | centreon/centreon | Centreon SQL Injection | high | 8.8 | 2% |
| CVE-2020-25379 | recall-products (WordPress plugin) | Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an a | high | 8.8 | 2% |
| CVE-2015-9448 | sendpress (WordPress plugin) | The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter. | high | 8.8 | 2% |
| CVE-2015-9454 | smooth-slider (WordPress plugin) | The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id pa | high | 8.8 | 2% |
| CVE-2015-9460 | booking-system (WordPress plugin) | The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter. | high | 8.8 | 2% |
| CVE-2020-8435 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form | high | 8.1 | 2% |
| CVE-2018-13448 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in product/card.php | critical | 9.8 | 2% |
| CVE-2018-13449 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in product/card.php | critical | 9.8 | 2% |
| CVE-2018-13450 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in product/card.php | critical | 9.8 | 2% |
| CVE-2015-9461 | awesome-filterable-portfolio (WordPress plugin) | The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_portfolio_item_page SQL injection via the item_id parameter | high | 7.2 | 2% |
| CVE-2015-9462 | awesome-filterable-portfolio (WordPress plugin) | The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter. | high | 7.2 | 2% |
| CVE-2016-10951 | fs-shopping-cart (WordPress plugin) | The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter. | high | 7.2 | 2% |
| CVE-2022-3689 | html-forms (WordPress plugin) | The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a | high | 7.2 | 2% |
| CVE-2021-24551 | edit-comments (WordPress plugin) | The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in | critical | 9.8 | 2% |
| CVE-2017-18597 | jtrt-responsive-tables (WordPress plugin) | The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId | high | 8.8 | 2% |
| CVE-2022-1505 | rsvpmaker (WordPress plugin) | The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user s | critical | 9.8 | 2% |
| CVE-2015-9449 | microblog-poster (WordPress plugin) | The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php accou | high | 7.2 | 2% |
| CVE-2016-10943 | zx-csv-upload (WordPress plugin) | The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter. | high | 7.2 | 2% |
| CVE-2018-7269 | yiisoft/yii2-dev, yiisoft/yii2 | Yii SQL injection vulnerability | critical | 9.8 | 2% |
| CVE-2021-24221 | quiz-and-survey-master (WordPress plugin) | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET paramet | high | 8.8 | 2% |
| CVE-2019-17072 | new-contact-form-widget (WordPress plugin) | The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query | critical | 9.8 | 2% |
| CVE-2022-2067 | francoisjacquet/rosariosis | SQL Injection in RosarioSIS | critical | 9.1 | 2% |
| CVE-2016-10917 | search-everything (WordPress plugin) | The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CV | critical | 9.8 | 2% |
| CVE-2017-17897 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in comm/multiprix.php | critical | 9.8 | 2% |
| CVE-2017-17899 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in adherents/subscription/info.php | critical | 9.8 | 2% |
| CVE-2017-17900 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability in fourn/index.php | critical | 9.8 | 2% |
| CVE-2019-10913 | symfony/http-foundation, symfony/symfony | Invalid HTTP method overrides allow possible XSS or other attacks in Symfony | critical | 9.8 | 2% |
| CVE-2015-9301 | liveforms (WordPress plugin) | The liveforms plugin before 3.2.0 for WordPress has SQL injection. | critical | 9.8 | 2% |
| CVE-2015-9310 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues. | critical | 9.8 | 2% |
| CVE-2016-10887 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues. | critical | 9.8 | 2% |
| CVE-2016-10888 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues. | critical | 9.8 | 2% |