VulnSocial

CVE-2018-25347Disclosure

LOWCVSS 7.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-05-24: 2Technical Details · 2026-05-24: 205-24
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2018-25347 WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormM… https://www.cve.org/CVERecord?id=CVE-2018-25347 ----- Traducción: CVE-2018-25347 Wor… http://infoflow.cloud`

    Post summary

    The post announces CVE-2018-25347, a SQL injection flaw in WordPress Contact Form Maker 1.12.20 that requires authenticated access; no exploitation, patch, or PoC details are provided.

    0000038
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2018-25347 WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormM… https://www.cve.org/CVERecord?id=CVE-2018-25347

    Post summary

    The text announces that WordPress Contact Form Maker Plugin 1.12.20 has a CVE‑2018‑25347 SQL injection flaw allowing authenticated users to manipulate database queries; no PoC or exploit is referenced.

    00000436
    57.5K followersView on X

Explore more

Back to dashboard