CVE-2025-15441

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15441", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-01-02T16:38:55.479Z", "datePublished": "2026-04-13T06:00:11.088Z", "dateUpdated": "2026-04-13T15:04:26.883Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-04-13T06:00:11.088Z"}, "title": "Form Maker < 1.15.38 - SQL Injection", "problemTypes": [{"descriptions": [{"description": "CWE-89 SQL Injection", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Form Maker by 10Web", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.15.38"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the \"MySQL Mapping\" feature is in use, which could make SQL Injection attacks possible in certain contexts."}], "references": [{"url": "https://wpscan.com/vulnerability/41f69b0a-4d17-4a6b-b803-ea1c370e3cc0/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "hiariz", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T15:03:55.515711Z", "id": "CVE-2025-15441", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:04:26.883Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-15441", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:03:55.515711Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:04:23.419Z"}}], "cna": {"title": "Form Maker < 1.15.38 - SQL Injection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "hiariz"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Form Maker by 10Web", "versions": [{"status": "affected", "version": "0", "lessThan": "1.15.38", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/41f69b0a-4d17-4a6b-b803-ea1c370e3cc0/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the \"MySQL Mapping\" feature is in use, which could make SQL Injection attacks possible in certain contexts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-89 SQL Injection"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-04-13T06:00:11.088Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15441", "state": "PUBLISHED", "dateUpdated": "2026-04-13T15:04:26.883Z", "dateReserved": "2026-01-02T16:38:55.479Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-04-13T06:00:11.088Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Form Maker by 10Web", "vendor": "Unknown", "versions": [{"lessThan": "1.15.38", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the \"MySQL Mapping\" feature is in use, which could make SQL Injection attacks possible in certain contexts."}, {"lang": "es", "value": "El plugin de WordPress Form Maker de 10Web anterior a la versi\u00f3n 1.15.38 no prepara adecuadamente las consultas SQL cuando la funci\u00f3n 'MySQL Mapping' est\u00e1 en uso, lo que podr\u00eda hacer posibles los ataques de inyecci\u00f3n SQL en ciertos contextos."}], "id": "CVE-2025-15441", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15441", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T15:03:55.515711Z", "version": "2.0.3"}}]}, "published": "2026-04-13T07:16:07.213", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/41f69b0a-4d17-4a6b-b803-ea1c370e3cc0/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.15.38)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Form Maker by 10Web", "source": "cna", "vendor": "Unknown"}, "product": "form_maker", "vendor": "10web"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-13T18:40:18.236302+00:00", "value": {"mitigation_remediation": ["Upgrade the Form Maker plugin to version 1.15.38 or later.", "Disable the MySQL Mapping feature if it is not required.", "Verify that all user input is properly escaped by the plugin by testing with a web vulnerability scanner."], "summary": {"action": "Patch Immediately", "impact": "SQL Injection"}, "threat_synthesis": {"affected_systems": "The affected system is the Form Maker plugin distributed by 10Web for WordPress. The flaw exists in all releases prior to version 1.15.38. Hosts running older versions of this plugin\u2014particularly sites that have enabled the MySQL Mapping feature\u2014are at risk. No other products or platforms are mentioned, so the scope is limited to WordPress sites using this specific plugin.", "description_and_impact": "The vulnerability lies in the Form Maker plugin for WordPress, where the MySQL Mapping feature fails to properly escape input before executing database queries. This flaw permits an attacker to inject arbitrary SQL statements, potentially modifying, deleting, or exfiltrating data stored by the site. Because the issue is tied to a plugin that runs in a web context, successful exploitation could compromise the confidentiality, integrity, or availability of database contents used by the affected WordPress installation.", "risk_and_exploitability": "The CVSS base score of 6.8 places the issue in the medium severity range, indicating that a successful exploit would have non\u2011negligible impact. The EPSS score is below 1\u202f%, suggesting that exploitation is relatively uncommon, and the flaw is not yet listed in CISA\u2019s KEV catalog. Inference: the attack vector is web\u2011based; an attacker needs the ability to submit crafted form data or otherwise trigger the MySQL Mapping logic, which is typically accessible to authenticated or unauthenticated users, depending on plugin settings. The lack of defensive payload preparation simplifies the exploit path."}}}}, "created": "2026-04-13T12:36:59.415295+00:00", "updated": "2026-04-14T16:35:24.775527+00:00", "vendors": ["10web", "10web$PRODUCT$form_maker", "wordpress", "wordpress$PRODUCT$wordpress"]}