CVE-2025-13409

Name of the Vulnerable Software and Affected Versions Form Vibes – Database Manager for Forms plugin for WordPress versions up to and including 1.4.13

Description The software contains a SQL Injection issue due to insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries. Specifically, the params parameter is vulnerable. This allows authenticated attackers with Administrator-level access or higher to inject additional SQL queries into existing ones, potentially extracting sensitive information from the database.

Recommendations Update Form Vibes – Database Manager for Forms plugin for WordPress to a version later than 1.4.13.