WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting

WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can injec...

WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting

WordPress Photo Gallery by 10Web plugin before 1.5.69 contains multiple reflected cross-site scripting vulnerabilities via the galleryid, tag, albumid and themeid GET parameters passed to the bwgfrontenddata AJAX action, available to both unauthenticated and authenticated users. id: CVE-2021-2429...

Seo By 10Web < 1.2.7 - Cross-Site Scripting

The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id:...

Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting

Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowdtabsactive parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can...

WordPress Form Maker by 10Web plugin < 1.15.51 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Maciek Komorowski in WordPress Plugin Form Maker by 10Web versions 1.15.51...

CVE-2026-105413

The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who vie...

EUVD-2026-116712

The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who vie...

CVE-2026-105413

The Form Maker by 10Web WordPress plugin, in versions before 1.15.51 , is vulnerable to Unauthenticated Stored XSS . The root cause is the inconsistent escaping of user-submitted field values before they are rendered on the plugin's submissions admin page. An unauthenticated attacker can store a ...

CVE-2026-105413 Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values

The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who vie...

Photo Gallery by 10Web < 1.6.0 - SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection id:...

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...

CVE-2026-118081

Contributor PHP Object Injection in 10Web Social Photo Feed = 1.5.6 versions...

CVE-2026-118081 WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

Contributor PHP Object Injection in 10Web Social Photo Feed = 1.5.6 versions...

CVE-2026-118081 WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

Contributor PHP Object Injection in 10Web Social Photo Feed = 1.5.6 versions...

EUVD-2026-112998

Contributor PHP Object Injection in 10Web Social Photo Feed = 1.5.6 versions...

CVE-2026-118081

The 10Web Social Photo Feed plugin for WordPress, affecting versions

PT-2026-132255

Contributor PHP Object Injection in 10Web Social Photo Feed = 1.5.6 versions...

CVE-2026-118081: 10Web 10Web Social Photo Feed: Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.

Contributor PHP Object Injection in 10Web Social Photo Feed = 1.5.6 versions...

WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 10Web Social Photo Feed versions = 1.5.6...

10Web Booster: RCE

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...