8.1
High
CVE-2026-16977 The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that…
Description
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Form Maker by 10Web 1.15 | earliest → < 1.15.45 | 1.15.45 |
Other CVEs of Form Maker by 10Web
The 11 CVEs of Form Maker by 10Web →
CVE-2026-105413
Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values
7.5
High
CVE-2025-15441
The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL…
6.8
Medium
CVE-2024-13053
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which…
4.8
Medium
CVE-2024-10680
The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which…
4.8
Medium