CVE-2019-10866

The CVE-2019-10866 vulnerability affects WordPress Form Maker plugin prior to version 1.13.3. A SQL injection exists in the get_labels_parameters flow inside form-maker/admin/models/Submissions_fm.php, triggered by crafted values (notably via the asc_or_desc parameter in PoC scenarios). Documente...

CVE-2023-4666

The Form Maker by 10Web WordPress plugin versions prior to 1.15.20 is vulnerable to an unauthenticated arbitrary file upload flaw. The root cause is a failure to validate signatures when creating them on the server using user input. This allows an unauthenticated attacker to create arbitrary file...

CVE-2023-45070

CVE-2023-45070 affects WordPress Form Maker by 10Web (Mobile-Friendly Drag & Drop Contact Form Builder)

CVE-2024-2112

The CVE-2024-2112 entry concerns the WordPress plugin Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder, affected up to version 1.15.22. The vulnerability, described across sources (NVD/NVD-related, Red Hat, PatchStack), is Sensitive Information Exposure via the plugin’s sign...

CVE-2022-3300

CVE-2022-3300 affects the WordPress plugin “Form Maker by 10Web” prior to version 1.15.6. The root cause is improper sanitization/escaping of a parameter before it is used in a SQL statement, resulting in a SQL injection. Impact is described as exploitable by high-privilege users such as admins, ...

CVE-2023-45071

The CVE CVE-2023-45071 affects the WordPress plugin Form Maker by 10Web (Mobile-Friendly Drag & Drop Contact Form Builder) 1.15.18, specifically fixed in 1.15.19, or apply vendor-supplied mitigations. Product references in connected docs confirm attack surface and patch status.

CVE-2024-10680

The Form Maker by 10Web WordPress plugin versions prior to 1.15.32 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the insufficient sanitization and escaping of certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to perfo...

CVE-2024-2258

CVE-2024-2258 (Form Maker by 10Web, WordPress): Stored XSS vulnerability in forms via a user’s display name autofill. Affected versions are all until 1.15.24 due to insufficient input sanitization and output escaping. Exploitation requires subscriber-level access and above, enabling arbitrary scr...

CVE-2024-32534

CVE-2024-32534 affects Form Maker (WordPress plugin) by 10Web, with stored XSS due to improper input neutralization during web page generation. Public references confirm the issue and affected range (Form Maker by 10Web:

CVE-2024-8633

CVE-2024-8633 – Form Maker by 10Web for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to 1.15.27. The root cause is insufficient input sanitization and output escaping in the plugin, which allows an authenticated attacker with Administrator-level ac...

CVE-2024-13605

The Form Maker by 10Web WordPress plugin (versions prior to 1.15.33 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to execute malicious script...

CVE-2019-11590

The 10Web Form Maker plugin for WordPress is affected by CVE-2019-11590 (versions

CVE-2023-48290

Form Maker by 10Web WordPress plugin

CVE-2024-10558

The Form Maker by 10Web WordPress plugin, in versions prior to 1.15.30 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain settings. This vulnerability allows high-privilege users, such as administrators, to perform XSS atta...

CVE-2024-43220

CVE-2024-43220 is a reflected XSS in the WordPress plugin “Form Maker by 10Web – Mobile-Friendly Drag & Drop Form Builder.” The vulnerability arises from improper input neutralization during web page generation, enabling a reflected XSS payload. Affected releases are Form Maker by 10Web up to 1.1...

CVE-2021-24526

CVE-2021-24526 affects the WordPress plugin Form Maker (by 10Web) prior to version 1.13.60. The issue is an authenticated Stored XSS caused by not escaping the Form Title when outputting it in an HTML attribute while editing a form in the admin dashboard. Impact is limited to authenticated users ...

CVE-2024-6130

The Form Maker by 10Web WordPress plugin versions prior to 1.15.26 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings, allowing high-privilege users, such as administrators, to execute malicious script...

CVE-2024-10560

The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVE-2024-10265

CVE-2024-10265 affects the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder for WordPress. It enables a Reflected Cross‑Site Scripting via the use of add_query_arg without proper escaping in the URL, impacting all versions up to and including 1.15.30. Unauthenticated attacke...

CVE-2024-10562

The Form Maker by 10Web WordPress plugin (versions prior to 1.15.31 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings when handling user-supplied data. This allows high-privilege users, such as administrato...

CVE-2024-34437

Technical details beyond the vulnerability description are not provided in the connected documents. No explicit exploit path, affected components, root cause, or remediation details are included. Monitor for official advisories for deeper technical information and fixes.

CVE-2024-13053

The Form Maker by 10Web WordPress plugin, in versions prior to 1.15.33 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to perform XSS attacks. This vulne...