What’s Vulnerable › Vulnerabilities
CVE-2025-15441: Form Maker < 1.15.38 - SQL Injection
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-13 · updated 2026-10-07
- Weakness: CWE-89
Description
The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.
Affected products
- 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: before 1.15.38 — fixed in 1.15.38
How to fix
Upgrade to a fixed version: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder 1.15.38. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-15441 or the next vulnerability affects your stack