Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-9082 KEV | drupal/core | Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to pr | critical | 9.8 | 89% |
| CVE-2026-60137 KEV | WordPress core | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query | medium | 5.9 | 5% |
| CVE-2022-21661 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitizatio | high | 8.0 | 98% |
| CVE-2020-11530 | chop-slider (WordPress plugin) | A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter | critical | 9.8 | 95% |
| CVE-2020-14092 | payment-form-for-paypal-pro (WordPress plugin) | The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. | critical | 9.8 | 95% |
| CVE-2023-23488 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' para | critical | 9.8 | 92% |
| CVE-2024-1071 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | critical | 9.8 | 89% |
| CVE-2021-24762 | perfect-survey (WordPress plugin) | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL stateme | critical | 9.8 | 87% |
| CVE-2019-20361 | email-subscribers-\&-newsletters (WordPress plugin) | There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the data | critical | 9.8 | 85% |
| CVE-2024-10400 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2. | high | 7.5 | 83% |
| CVE-2021-25114 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthentica | critical | 9.8 | 82% |
| CVE-2022-25148 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id p | critical | 9.8 | 81% |
| CVE-2021-24931 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_r | critical | 9.8 | 79% |
| CVE-2024-1512 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via | critical | 9.8 | 78% |
| CVE-2024-1698 | notificationx (WordPress plugin) | The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulner | critical | 9.8 | 78% |
| CVE-2022-25149 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter foun | critical | 9.8 | 77% |
| CVE-2019-10692 | wp-google-maps (WordPress plugin) | In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before | critical | 9.8 | 77% |
| CVE-2022-0169 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using | critical | 9.8 | 75% |
| CVE-2015-6522 | wp-symposium (WordPress plugin) | SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands v | high | 7.5 | 74% |
| CVE-2022-0412 | ti-woocommerce-wishlist (WordPress plugin) | The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and e | critical | 9.8 | 74% |
| CVE-2023-6063 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, lea | high | 7.5 | 74% |
| CVE-2021-24946 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL state | critical | 9.8 | 73% |
| CVE-2021-24862 | registrationmagic (WordPress plugin) | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL | high | 7.2 | 73% |
| CVE-2024-0637 | centreon/centreon | Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability | high | 8.8 | 72% |
| CVE-2018-10094 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability | critical | 9.8 | 70% |
| CVE-2024-23115 | centreon/centreon | Centreon updateGroups SQL Injection Remote Code Execution Vulnerability | high | 7.2 | 67% |
| CVE-2024-3552 | web-directory-free (WordPress plugin) | The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX | critical | 9.8 | 67% |
| CVE-2021-24321 | bello (WordPress plugin) | The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_no | critical | 9.8 | 67% |
| CVE-2022-1429 | pimcore/pimcore | SQL Injection found in Pimcore | high | 7.5 | 64% |
| CVE-2023-5652 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before | critical | 9.8 | 64% |
| CVE-2020-26935 | phpmyadmin/phpmyadmin | phpMyAdmin SQL injection vulnerability | critical | 9.8 | 64% |
| CVE-2023-6360 | my-calendar (WordPress plugin) | The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' pa | high | 8.6 | 63% |
| CVE-2024-8522 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/ | critical | 10.0 | 63% |
| CVE-2023-1578 | pimcore/pimcore | Pimcore Remote Code Execution vulnerability in Search function | medium | 6.5 | 63% |
| CVE-2023-0631 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes d | high | 8.8 | 60% |
| CVE-2023-23492 | login-with-phone-number (WordPress plugin) | The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' param | high | 8.8 | 57% |
| CVE-2025-6970 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ | high | 7.5 | 56% |
| CVE-2022-0513 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason | critical | 9.8 | 53% |
| CVE-2024-23116 | centreon/centreon | Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability | high | 7.2 | 53% |
| CVE-2024-23117 | centreon/centreon | Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability | high | 7.2 | 53% |
| CVE-2024-23118 | centreon/centreon | Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability | high | 7.2 | 53% |
| CVE-2024-37843 | craftcms/cms | Craft CMS SQL injection vulnerability via the GraphQL API endpoint | critical | 9.8 | 53% |
| CVE-2024-3922 | dokan (WordPress plugin) | The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due | critical | 10.0 | 53% |
| CVE-2020-27615 | loginizer (WordPress plugin) | The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip | critical | 9.8 | 53% |
| CVE-2021-36393 | moodle/moodle | Moodle SQL Injection vulnerability | critical | 9.8 | 52% |
| CVE-2023-6567 | learnpress (WordPress plugin) | The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and includ | critical | 9.8 | 51% |
| CVE-2021-44427 | francoisjacquet/rosariosis | SQL Injection in rosariosis | critical | 9.8 | 51% |
| CVE-2018-16159 | gift-vouchers (WordPress plugin) | The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_do | critical | 9.8 | 50% |
| CVE-2024-8275 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function | critical | 9.8 | 50% |
| CVE-2020-6010 | learnpress (WordPress plugin) | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection | high | 8.8 | 49% |