{"id":"CVE-2026-16977","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-16977","summary":"The Form Maker by 10Web  WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed…","details":"The Form Maker by 10Web  WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.","published":"2026-08-12T06:19:18.193","modified":"2026-08-12T06:19:18.193","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://wpscan.com/vulnerability/70430b75-9b5e-4f47-8b37-7be1da5ba063/"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T06:19:18.193"}}