by Kastro
Paper/Archive/CVE-2025-31424

CVE-2025-31424

kamleshyadav WP Lead Capturing Pages — WordPress WP Lead Capturing Pages plugin < 2.6 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 37.8.378 × 207.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.

Affected

ProductAffectedFixed inSource
WP Lead Capturing Pages≤ 2.6–CNA

Scores by source

Patchstack (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refpatchstack.com/database/Wordpress/Plugin/leadcapture/vulnerability/wordpress-wp-lead-capturing-pages-plugin-2-3-sql-injection-vulnerability?_s_id=cve