Back to Database
Status published
Critical
CVE-2025-31424
WordPress WP Lead Capturing Pages plugin < 2.6 - SQL Injection vulnerability
Vulnerability Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-31424
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
More from kamleshyadav
View All →CVE-2025-69009
WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability
Medium
5.3
CVE-2025-67998
WordPress Miraculous Elementor plugin <= 2.0.7 - Broken Authentication vulnerability
High
8.8
CVE-2025-58961
WordPress CF7 Auto Responder Addon plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability
High
7.1
CVE-2025-58641
WordPress Exit Intent Popup Plugin <= 1.0.1 - Server Side Request Forgery (SSRF) Vulnerability
Medium
5.4
CVE-2025-58629
WordPress Miraculous theme < 2.0.9 - Arbitrary Content Deletion vulnerability
High
7.5
Affected Vendor
kamleshyadav
View all reports →Affected Software
WP Lead Capturing Pages
Vulnerable Versions:
0
Timeline
Official Publish:
June 9th, 2025
Last Modified:
May 12th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L