CVE-2026-16977

None

Open

TLP:CLEAR

Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.

Details

Confidence: 90%
Published: Aug 12, 2026
Last Modified: Aug 12, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.