CVE-2023-45071

Unauth. Stored Cross-Site Scripting XSS vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin = 1.15.18 versions...

PT-2023-29390 · 10Web · 10Web Form Builder Team Form Maker

Name of the Vulnerable Software and Affected Versions: 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin versions = 1.15.18 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for malicious...

WordPress Plugin Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Form Maker by 10Web -...

CVE-2023-4666

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE...

VulnCheck KEV: CVE-2023-4666

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE...

CVE-2021-46889

The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via themeid for bwgfrontenddata. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693...

CVE-2023-2224

The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2023-19880 · 10Web · 10Web Social Post Feed

Name of the Vulnerable Software and Affected Versions: 10Web Social Post Feed WordPress plugin versions prior to 1.2.9 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because some parameters are not properly sanitised and escaped before being outputted bac...

PT-2023-6579 · 10Web · Seo By 10Web Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: SEO by 10Web WordPress plugin versions prior to 1.2.7 Description: The issue is related to the SEO by 10Web WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...

WordPress Plugin SEO by 10Web 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-17958 · 10Web · The Image Optimizer

Name of the Vulnerable Software and Affected Versions: The Image Optimizer by 10web WordPress plugin versions prior to 1.0.27 Description: The issue allows high-privileged users, such as admins, to inspect names of files and directories outside of the site's root. This is due to the plugin not...

WordPress plugin Image Optimizer by 10web 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A path traversal vulnerability in the WordPress plugin...

VulnCheck KEV: CVE-2021-24139

Unvalidated input in the Photo Gallery 10Web Photo Gallery WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwgsearchx parameter...

Krisp: SQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.ai

The tenweb-speed-optimizer WordPress plugin prior to version 2.12.22 was vulnerable to unauthenticated SQL injection in /wp-json/tenwebio/v2/compress-one, which could be exploited to gain remote code execution by chaining it with insecure deserialization...

CVE-2021-31693

The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via albumgalleryid0, bwgalbumsearch0, and type0 for bwgfrontenddata. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware information, previously connected to this CVE ID becau...

WordPress plugin The 10Web Photo Gallery 安全漏洞

VMware Tools for Windows 10.0.0 and later, but prior to version 12.1.5, contain a denial of service vulnerability. A denial of service vulnerability exists in the VM3DMP driver, which is caused by improper input validation in the VM3DMP driver and can be exploited by an attacker with local user...

CVE-2022-1564

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1564

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1320

The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1282

The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $GET'imageurl' variable, which is reflected back to the users when executing the editimagebwg AJAX action...