8.1
Élevée
CVE-2026-16977 The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that…
Description
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Form Maker by 10Web 1.15 | premières → < 1.15.45 | 1.15.45 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Form Maker by 10Web
Les 11 CVE de Form Maker by 10Web →
CVE-2026-105413
Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values
7.5
Élevée
CVE-2025-15441
The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL…
6.8
Moyenne
CVE-2024-13053
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which…
4.8
Moyenne
CVE-2024-10680
The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which…
4.8
Moyenne