Threat Entry Updated 2026-04-14

CVE-2026-4388 - Form Maker By 10web Plugin

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization (`sanitize_text_field` strips tags but not quotes) and missing output escaping when rendering submission data in the admin Submissions view. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript through a form submission that executes in the browser of an administrator who views the submission details.

PLUGIN Form Maker By 10web

CVE-2026-4388

HIGH CVSS 7.2 2026-04-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-15

CVE-2026-1065 - Form Maker By 10web Plugin

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.

PLUGIN Form Maker By 10web

CVE-2026-1065

HIGH CVSS 7.2 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-06-09

CVE-2024-13053 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Form Maker By 10web

CVE-2024-13053

MEDIUM CVSS 4.8 2025-05-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-04-23

CVE-2024-10680 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Form Maker By 10web

CVE-2024-10680

MEDIUM CVSS 4.8 2025-04-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-04-03

CVE-2024-10560 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Form Maker By 10web

CVE-2024-10560

LOW CVSS 3.5 2025-03-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-13

CVE-2024-10558 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Form Maker By 10web

CVE-2024-10558

LOW CVSS 3.5 2025-03-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-07

CVE-2024-13605 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Form Maker By 10web

CVE-2024-13605

MEDIUM CVSS 4.8 2025-02-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-08

CVE-2024-10562 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Form Maker By 10web

CVE-2024-10562

LOW CVSS 2.7 2025-01-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-01

CVE-2024-6130 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Form Maker By 10web

CVE-2024-6130

MEDIUM CVSS 4.8 2024-07-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-04-23

CVE-2023-4666 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE

PLUGIN Form Maker By 10web

CVE-2023-4666

CRITICAL CVSS 9.8 2023-10-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-09

CVE-2022-3300 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

PLUGIN Form Maker By 10web

CVE-2022-3300

HIGH CVSS 7.2 2022-10-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-1564 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

PLUGIN Form Maker By 10web

CVE-2022-1564

MEDIUM CVSS 4.8 2022-05-30

Risk Score

Open Full Technical Breakdown