PT-2025-37914 · WordPress · Form To Database

Sascha Egerer · Published 2025-09-16 · Updated 2025-09-16 · CVE-2025-10316

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Form to Database versions prior to 2.2.5 Form to Database versions 3.0.0 through 3.2.2 Form to Database versions 4.0.0 through 4.2.3 Form to Database versions 5.0.0 through 5.0.2

Description The extension "Form to Database" is susceptible to Cross-Site Scripting.

Recommendations Update to a version prior to 2.2.5. Update to a version prior to 3.0.0 or after 3.2.2. Update to a version prior to 4.0.0 or after 4.2.3. Update to a version prior to 5.0.0 or after 5.0.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-10316

GHSA-54PG-2X9H-CMX8

Affected Products

Form To Database

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-10316 · Security Note
• https://osv.dev/vulnerability/GHSA-54pg-2x9h-cmx8 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-ext-sa-2025-012 · Note
• https://gitlab.com/lavitto/typo3-form-to-database · Note
• https://gitlab.com/lavitto/typo3-form-to-database/-/issues/135 · Note
• https://twitter.com/CVEnew/status/1967965155364573318 · Twitter Post
• https://t.me/CVEtracker/32615 · Telegram Post
• https://gitlab.com/lavitto/typo3-form-to-database/-/commit/a3ab9bf9c04061d1841fff96a08c4dbf48aaaf37 · Note