VulnSocial

CVE-2026-3359Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-05-05); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-05-05: 2Mentions · 2026-05-18: 1Technical Details · 2026-05-05: 205-0505-18
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-052
Disclosure2
2026-05-181
General1
Full discourse3 posts
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    【脆弱性情報】 CVE-2026-3359 10WebのForm Makerの脆弱性について #cybernote #ブログ仲間と繋がりたい #Webライター https://www.cybernote.click/2026/05/18/%e3%80%90%e8%84%86%e5%bc%b1%e6%80%a7%e6%83%85%e5%a0%b1%e3%80%91-cve-2026-3359-10web%e3%81%aeform-maker%e3%81%ae%e8%84%86%e5%bc%b1%e6%80%a7%e3%81%ab%e3%81%a4%e3%81%84%e3%81%a6/

    Post summary

    The text references CVE‑2026‑3359 for 10Web Form Maker and links to a blog post, but provides no further technical details or actionable information.

    0000065
    206 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-3359 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up… https://www.cve.org/CVERecord?id=CVE-2026-3359 ----- Traducción: CVE-2026-3359 The… http://infoflow.cloud`

    Post summary

    A new SQL injection vulnerability (CVE‑2026‑3359) has been disclosed for the Form Maker plugin for WordPress, but no exploitation or patch information is reported.

    00000166
    75 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-3359 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up… https://www.cve.org/CVERecord?id=CVE-2026-3359

    Post summary

    CVE-2026-3359 is a SQL injection vulnerability in the 10Web Form Maker plugin affecting the 'inputs' parameter; no proof‑of‑concept, exploit code, active exploitation or patch is mentioned.

    00000263
    57.4K followersView on X

Explore more

Back to dashboard