Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE. id: CVE-2023-4666 info: name: Form-Maker 1.15.20 - Unauthenticated Arbitrary File Upload author: pussycat0x severity: critical...

Combo Blocks < 2.2.76 - Improper Access Control

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts id:...

WordPress Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by lhking in WordPress Plugin Form Maker by 10Web versions = 1.15.47...

CVE-2026-96813

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-96813 Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-96813

The Form Maker by 10Web WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.15.47 . The root cause is insufficient input sanitization and output escaping within the Mark on Map Longitude/Latitude Fields . This allows unauthenticated attackers ...

EUVD-2026-90571

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

cve-2026-3359-exp

CVE-2026-3359 est une vulnérabilité d'injection SQL non authentifiée située dans le plugin WordPress « Form Maker » de Web10 dans toutes les versions jusqu'à la version 1.15.42. Afin d'utiliser ce PoC/exploit, commencez par configurer un environnement virtuel via les commandes « virtualenv...

WordPress Form Maker by 10Web has a cross-site scripting vulnerability

WordPress Form Maker By 10Web is a drag-and-drop form builder plugin. WordPress Form Maker By 10Web has a cross-site scripting vulnerability. This vulnerability stems from the bulkaction parameter not properly verifying inputs and escaping output data. Attackers can exploit this vulnerability to...

CVE-2026-85645

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-85645

The Form Maker by 10Web WordPress plugin (versions ≤ 1.15.46 ) is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts into pages if a user clicks a crafted...

CVE-2026-85645 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-75254

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-85645 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-85645: Improper Neutralization of Input During Web Page Generation

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-89280

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-66616

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.48...

EUVD-2026-63300

Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...

CVE-2026-66616 WordPress Form Maker by 10Web plugin <= 1.15.48 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.48...

CVE-2026-66616 WordPress Form Maker by 10Web plugin <= 1.15.48 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.48...