Plugin icon

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

form-maker

Vulnerabilities:

33

Last Updated:

March 27, 2026

Active Installs:

40000

Published
Title
Fixed in
CVSS
Published
2026-03-23
Title
Form Maker < 1.15.38 - SQL Injection
Fixed in
Fixed in 1.15.38
CVSS
6.8 (medium)
Published
2026-02-02
Title
Form Maker by 10Web < 1.15.36 - Unauthenticated Stored Cross-Site Scripting via Hidden Field
Fixed in
Fixed in 1.15.36
CVSS
7.1 (high)
Published
2026-02-02
Title
Form Maker by 10Web < 1.15.36 - Unauthenticated Stored Cross-Site Scripting via SVG file
Fixed in
Fixed in 1.15.36
CVSS
7.2 (high)
Published
2025-05-19
Title
Form Maker by 10Web < 1.15.34 - Admin+ Stored XSS
Fixed in
Fixed in 1.15.34
CVSS
3.5 (low)
Published
2025-03-26
Title
Form Maker by 10Web < 1.15.32 - Admin+ Stored XSS
Fixed in
Fixed in 1.15.32
CVSS
3.5 (low)
Published
2025-03-03
Title
Form Maker by 10Web < 1.15.30 - Admin+ Stored XSS
Fixed in
Fixed in 1.15.30
CVSS
3.5 (low)
Published
2025-03-02
Title
Form Maker by 10Web < 1.15.30 - Admin+ Stored XSS
Fixed in
Fixed in 1.15.30
CVSS
3.5 (low)
Published
2025-02-03
Title
Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS
Fixed in
Fixed in 1.15.33
CVSS
3.5 (low)
Published
2024-12-30
Title
Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme Title
Fixed in
Fixed in 1.15.33
CVSS
3.5 (low)
Published
2024-12-17
Title
Form Maker by 10Web < 1.15.31 - Admin+ Stored XSS
Fixed in
Fixed in 1.15.31
CVSS
3.5 (low)
Published
2024-12-03
Title
Multiple Plugins - Contributor+ DOM-Based Stored XSS via FancyBox JavaScript Library
Fixed in
Fixed in 1.15.28
CVSS
5.9 (medium)
Published
2024-11-10
Title
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.31 - Reflected Cross-Site Scripting via add_query_arg Parameter
Fixed in
Fixed in 1.15.31
CVSS
6.1 (medium)
Published
2024-09-25
Title
Form Maker < 1.15.28 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.15.28
CVSS
5.5 (medium)
Published
2024-08-09
Title
Form Maker by 10Web < 1.15.27 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.15.27
CVSS
7.1 (high)
Published
2024-06-10
Title
Form Maker by 10Web < 1.15.26 - Admin+ Stored XSS
Fixed in
Fixed in 1.15.26
CVSS
n/a
Published
2024-05-07
Title
Form Maker by 10Web < 1.15.25 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.15.25
CVSS
4.4 (medium)
Published
2024-04-26
Title
Form Maker by 10Web < 1.15.25 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
Fixed in
Fixed in 1.15.25
CVSS
4.4 (medium)
Published
2024-04-15
Title
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.24 - Authenticated (Admin+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.15.24
CVSS
4.4 (medium)
Published
2024-03-22
Title
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.23 - Sensitive Information Exposure
Fixed in
Fixed in 1.15.23
CVSS
5.9 (medium)
Published
2024-01-26
Title
Form-Maker (twb_form-maker) < 1.15.22 - CSRF to limited RCE
Fixed in
Fixed in 1.15.22
CVSS
5.4 (medium)
Published
2023-10-11
Title
Form Maker < 1.15.21 - Captcha Bypass
Fixed in
Fixed in 1.15.21
CVSS
5.3 (medium)
Published
2023-10-03
Title
Form Maker by 10Web < 1.15.19 - Unauthenticated Stored XSS
Fixed in
Fixed in 1.15.19
CVSS
7.1 (high)
Published
2023-10-03
Title
Form Maker by 10Web < 1.15.19 - Reflected XSS
Fixed in
Fixed in 1.15.19
CVSS
7.1 (high)
Published
2023-09-19
Title
Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 1.15.20
CVSS
9.0 (critical)
Published
2022-10-03
Title
Form Maker by 10Web < 1.15.6 - Admin+ SQLI
Fixed in
Fixed in 1.15.6
CVSS
6.8 (medium)
Published
2022-05-09
Title
Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.14.12
CVSS
3.4 (low)
Published
2021-07-15
Title
Form Maker < 1.13.60 - Authenticated Stored XSS
Fixed in
Fixed in 1.13.60
CVSS
4.8 (medium)
Published
2020-07-12
Title
Form Maker by 10Web < 1.13.40 - Authenticated Reflected XSS
Fixed in
Fixed in 1.13.40
CVSS
8.3 (high)
Published
2020-05-26
Title
Form Maker by 10Web < 1.13.36 - Authenticated SQL Injection
Fixed in
Fixed in 1.13.36
CVSS
8.7 (high)
Published
2019-05-10
Title
Form Maker by 10Web < 1.13.3 - Authenticated SQL Injection
Fixed in
Fixed in 1.13.3
CVSS
8.1 (high)
Published
2019-04-05
Title
Form Maker by 10Web < 1.13.5 - Cross-Site Request Forgery (CSRF) to LFI
Fixed in
Fixed in 1.13.5
CVSS
7.5 (high)
Published
2018-05-01
Title
Form Maker by WD < 1.12.24 - CSV Injection
Fixed in
Fixed in 1.12.24
CVSS
4.4 (medium)
Published
2014-08-01
Title
Form Maker 1.6.4 - front_end_form_maker.php Unspecified XSS
Fixed in
Fixed in 1.6.6
CVSS
4.8 (medium)