CVE-2025-30810highCWE-89

CVE-2025-30810: high-severity vulnerability in Smackcoders Inc., Lead Form Data Collection to…

WordPress Lead Form Data Collection to CRM plugin <= 3.0.1 - SQL Injection vulnerability

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.4%
exploitation probability
0.4%top 63% of all CVEs
observed exploitation
nono source reports it
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Blind SQL Injection.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.0.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Affected products
Smackcoders Inc., · Lead Form Data Collection to CRM
Related CVEs — Smackcoders Inc., Lead Form Data Collection to…

In the same product, most dangerous first.

CVE-2025-47690HIGHWordPress Lead Form Data Collection to CRM plugin <= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 0.4%
References
https://patchstack.com/database/Wordpress/Plugin/wp-leads-builder-any-crm/vulnerability/wordpress-lead-form-data-collection-to-crm-plugin-3-0-1-sql-injection-vulnerability?_s_id=cve