CVE-2019-10866 - CVE House

Status published Critical CVE-2019-10866

In the Form Maker plugin before 1.13.3 for WordPress, it's...

9.8 CVSS

Vulnerability Description

In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10866

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from 10web

View All →

CVE-2025-2269

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter

Medium 6.1

CVE-2025-13377

10Web Booster <= 2.32.7 - Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache

Critical 9.6

CVE-2024-9878

Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting

Medium 4.4

CVE-2024-9607

10Web Social Post Feed <= 1.2.9 - Reflected Cross-Site Scripting

Medium 6.1

CVE-2024-8633

Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting

Medium 5.5

Affected Vendor

10web

View all reports →

Affected Software

form maker

Vulnerable Versions:

Timeline

Official Publish: May 23rd, 2019

Last Modified: August 4th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.