CVE-2022-3300

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

Score

CVSS 3.1 7.2 High

Status

Modified - contact@wpscan.com

Published

2022-10-25

Last modified

2025-05-09

Weaknesses

CWE-89

Affected products

• Form Maker (10web)
• Form Maker By 10web Mobile-friendly Drag Drop Contact Form Builder (Unknown)

References

• https://wpscan.com/vulnerability/ddc9ed69-d942-4fad-bbf4-1be3b86460d9