CVE-2026-16977
Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
| Vendor | unknown |
| Product | form maker by 10web |
| Published | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown form maker by 10web
Be the first to know when new unknown vulnerabilities affecting unknown form maker by 10web are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Form Maker by 10Web
0 < 1.15.45
References
Credits
Revanth Meesala WPScan