What’s Vulnerable › Products

10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder vulnerabilities

40 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.

Check whether your 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder version is affected

Latest 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder vulnerabilities

• CVE-2026-95808 — Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter (CVSS 7.5)
• CVE-2026-103998 — Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key (CVSS 6.1)
• CVE-2026-96813 — Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields (CVSS 7.2)
• CVE-2026-85645 — Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting (CVSS 6.1)
• CVE-2026-15993 — Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause (CVSS 5.3)
• CVE-2026-16977 — Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name (CVSS 8.1)
• CVE-2026-11777 — Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter (CVSS 4.9)
• CVE-2026-11776 — Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter (CVSS 4.9)
• CVE-2018-25346 — WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php (CVSS 7.1)
• CVE-2026-3359 — Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs' (CVSS 7.5)
• CVE-2026-3330 — Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter (CVSS 4.9)
• CVE-2026-4388 — Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box (CVSS 7.2)
• CVE-2025-15441 — Form Maker < 1.15.38 - SQL Injection (CVSS 6.8)
• CVE-2026-1065 — Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file (CVSS 7.2)
• CVE-2026-1058 — Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field (CVSS 7.1)
• CVE-2024-13053 — Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme Title (CVSS 4.8)
• CVE-2024-10680 — Form Maker by 10Web < 1.15.32 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-10560 — Form Maker by 10Web < 1.15.30 - Admin+ Stored XSS (CVSS 3.5)
• CVE-2024-10558 — Form Maker by 10Web < 1.15.30 - Admin+ Stored XSS (CVSS 3.5)
• CVE-2024-13605 — Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-10562 — Form Maker by 10Web < 1.15.31 - Admin+ Stored XSS (CVSS 2.7)
• CVE-2024-5020 — Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
• CVE-2024-10265 — Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter (CVSS 6.1)
• CVE-2024-8633 — Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.8)
• CVE-2024-43220 — WordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)