Security Advisory

CVE-2018-25347

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-23 18:30:48

Last updated 2026-05-26 18:39:44

Assigner VulnCheck

CVSS score 7.1

State PUBLISHED

Description

WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.

← Browse all CVEs View on cve.org ↗