CVE-2025-15441

Form Maker < 1.15.38 - SQL Injection

CVSS 6.8 MEDIUMEPSS 0.3%CWE-89

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS 6.8EPSS 0.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

13 Apr 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products

Unknown · Form Maker by 10Web

public PoCs found — 1

cve_referencewpscan.com/vulnerability/41f69b0a-4d17-4a6b-b803-ea1c370e3cc0/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://wpscan.com/vulnerability/41f69b0a-4d17-4a6b-b803-ea1c370e3cc0/