Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Pixel Form Builder plugin can expose site data

CVE-2025-31914 · published 1 year ago
Summary

The Pixel Form Builder and Autoresponder plugin for WordPress allows a type of attack called blind SQL injection, which could let a malicious user retrieve or change information stored in the website's database. This risk applies to all versions up to 1.0.2. Update the plugin to the latest version or replace it with a secure alternative, and review database access logs for any unexpected activity.

Original advisory text
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Blind ...
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Blind SQL Injection.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through <= 1.0.2.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published23 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-31914 · NVD
Track software like this
Free during beta