Skip to content
Noroxi

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

form-maker · plugin

Known security vulnerabilities for Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder. Find out in seconds which version runs on your site with WP Lens.

25 known vulnerabilities

2 critical · 17 exploitable without logging in · 1 with no official fix seen · 3 with public exploit code · latest Oct 1, 2026

Listed on wordpress.org · latest 1.15.48 · last updated Sep 28, 2026 · 30K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2019-10866unauthenticated

    In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the fi

    Critical 9.8

  • CVE-2026-39502unauthenticated≤ 1.15.38

    WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability

    Critical 9.3

  • CVE-2019-11590unauthenticated · needs a click

    The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local f

    High 8.8

  • CVE-2018-10504unauthenticated · needs a click

    The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.

    High 7.8

  • CVE-2026-3359unauthenticated≤ 1.15.42

    Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'

    High 7.5

  • CVE-2026-96813unauthenticated≤ 1.15.47

    Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields

    High 7.2

  • CVE-2026-4388unauthenticated≤ 1.15.40

    Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box

    High 7.2

  • CVE-2026-1065unauthenticated≤ 1.15.35

    Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file

    High 7.2

  • CVE-2026-66616unauthenticated · needs a clickno fix seen

    WordPress Form Maker by 10Web plugin <= 1.15.48 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-1058unauthenticated · needs a click≤ 1.15.35

    Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field

    High 7.1

  • CVE-2024-0667unauthenticated · needs a click≤ 1.15.21

    Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute

    Medium 6.3

  • CVE-2026-85645unauthenticated · needs a click≤ 1.15.46

    Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2024-10265unauthenticated · needs a click≤ 1.15.30

    Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter

    Medium 6.1

  • CVE-2024-43220unauthenticated · needs a click≤ 1.15.26

    WordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2023-45071unauthenticated · needs a click≤ 1.15.18

    WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2023-45070unauthenticated · needs a click≤ 1.15.18

    WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2025-48341high privilege≤ 1.15.33

    WordPress Form Maker by 10Web plugin <= 1.15.33 - Cross Site Scripting (XSS) Vulnerability

    Medium 5.9

  • CVE-2023-48290unauthenticated≤ 1.15.20

    WordPress Form Maker by 10Web plugin <= 1.15.20 - Captcha Bypass Vulnerability vulnerability

    Medium 5.3

  • CVE-2026-15993subscriber+≤ 1.15.44

    Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause

    Medium 5.3

  • CVE-2026-11777admin≤ 1.15.43

    Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter

    Medium 4.9

  • CVE-2026-11776admin≤ 1.15.43

    Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter

    Medium 4.9

  • CVE-2026-3330admin≤ 1.15.40

    Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter

    Medium 4.9

  • CVE-2024-8633admin≤ 1.15.27

    Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting

    Medium 4.8

  • CVE-2024-34437high privilege≤ 1.15.24

    WordPress Form Maker by 10Web plugin <= 1.15.24 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2024-32534high privilege≤ 1.15.23

    WordPress Form Maker plugin <= 1.15.23 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS). The record lists the latest wordpress.org release (1.15.48) as affected.

← Back to directory