PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-15441 10Web CVE debrief

The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the 'MySQL Mapping' feature is in use, potentially allowing SQL Injection attacks. This vulnerability could enable attackers to execute unauthorized SQL queries, leading to data breaches or system compromise. WordPress administrators and security teams should assess exposure and prioritize patching to version 1.15.38 or later, especially if the 'MySQL Mapping' feature is enabled. The CVE record and NVD entry provide limited information, and further investigation is required to determine the full scope of affected versions and potential impact.

Vendor
10Web
Product
Form Maker
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-13
Original CVE updated
2026-09-30
Advisory published
2026-04-13
Advisory updated
2026-09-30

Who should care

WordPress administrators, security teams, and developers using the Form Maker by 10Web plugin, especially those with the 'MySQL Mapping' feature enabled, should assess exposure and prioritize patching.

Why it matters

CVE-2025-15441 is a SQL Injection vulnerability in the Form Maker by 10Web WordPress plugin. Defenders should assess exposure, prioritize patching, and monitor for potential attacks. The CVE record and NVD entry provide limited information, and further investigation is required to determine the full scope of affected versions and potential impact.

  • Potential SQL Injection attacks may allow unauthorized access to sensitive data.
  • Successful exploitation could lead to data breaches or unauthorized modifications.
  • Defenders should verify inventory and patch levels to prevent potential attacks.
  • Further investigation is required to determine the full scope of affected versions and potential impact.

Technical summary

The Form Maker by 10Web WordPress plugin before 1.15.38 is vulnerable to SQL Injection attacks when the 'MySQL Mapping' feature is used due to improper SQL query preparation. This could allow attackers to inject malicious SQL code, potentially leading to unauthorized data access or modifications. Defenders should verify inventory and patch levels to prevent potential attacks and monitor for suspicious SQL activity. Further investigation is required to determine the full scope of affected versions and potential impact.

Defensive priority

Assess exposure and prioritize patching for WordPress installations using the Form Maker by 10Web plugin with the 'MySQL Mapping' feature enabled.

Recommended defensive actions

  • Assess exposure by checking if the Form Maker by 10Web plugin is installed and the 'MySQL Mapping' feature is enabled.
  • Prioritize patching to version 1.15.38 or later.
  • Monitor for potential SQL Injection attacks.
  • Verify inventory of WordPress installations and plugins.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is required to determine the full scope of affected versions and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-15441 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-15441

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-15441 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-15441

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.