Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE. id: CVE-2023-4666 info: name: Form-Maker 1.15.20 - Unauthenticated Arbitrary File Upload author: pussycat0x severity: critical...

Combo Blocks < 2.2.76 - Improper Access Control

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts id:...

cve-2026-3359-exp

CVE-2026-3359 is an unauthenticated SQL Injection vulnerability situated within Web10's wordpress plugin "Form Maker" in all versions up to version 1.15.42. In order to use this PoC/exploit, first set up a virtual enviroment through the commands "virtualenv name of your enviroment here" or "venv...

CVE-2026-119483

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50...

CVE-2026-119483

The 10Web Form Maker by 10Web WordPress plugin (versions n/a through 1.15.50 ) is vulnerable to a Stored Cross-site Scripting (XSS) vulnerability. This issue is caused by the improper neutralization of input during web page generation . The vulnerability allows an attacker to inject and store mal...

CVE-2026-119483 WordPress Form Maker by 10Web plugin <= 1.15.50 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50...

EUVD-2026-119923

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50...

CVE-2026-119483: 10Web Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50...

PT-2026-140331

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50...

WordPress Form Maker by 10Web plugin <= 1.15.50 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by xwashira in WordPress Plugin Form Maker by 10Web versions = 1.15.50...

CVE-2026-120512

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement Hidden Input field, name = user-defined, e.g. hiddenprobe' parameter in all versions up to, and including, 1.15.50 due to insufficien...

CVE-2026-118067

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement payload + disabledfields pivot' parameter in all versions up to, and including, 1.15.50 due to insufficient input sanitization and...

CVE-2026-118067

The Form Maker by 10Web WordPress plugin (versions up to and including 1.15.50 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the wdform__element and disabled_fields parameters. Unauthenticated attackers can i...

EUVD-2026-118565

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement payload + disabledfields pivot' parameter in all versions up to, and including, 1.15.50 due to insufficient input sanitization and...

CVE-2026-118067 Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement payload + disabledfields pivot' parameter in all versions up to, and including, 1.15.50 due to insufficient input sanitization and...

CVE-2026-120512 Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement Hidden Input field, name = user-defined, e.g. hiddenprobe' parameter in all versions up to, and including, 1.15.50 due to insufficien...

EUVD-2026-118548

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement Hidden Input field, name = user-defined, e.g. hiddenprobe' parameter in all versions up to, and including, 1.15.50 due to insufficien...

CVE-2026-120512

The Form Maker by 10Web WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.15.50 . The root cause is insufficient input sanitization and output escaping of the wdform__element parameter (a user-defined hidden input field). Unauthenticated attacke...

WordPress Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Form Maker by 10Web versions = 1.15.50...

WordPress Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Metzee Ops in WordPress Plugin Form Maker by 10Web versions = 1.15.50...