10web
10web Form Maker: vulnerabilidades y CVE
10web Form Maker tiene 38 vulnerabilidades publicadas, 13 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE38
Últimos 12 meses13
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-96813 | Alta (7.2) | — | — | 1 oct 2026 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and… |
| CVE-2026-85645 | Media (6.1) | 0.38% | — | 10 sept 2026 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46… |
| CVE-2026-66616 | Alta (7.1) | 0.25% | — | 20 ago 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through… |
| CVE-2026-15993 | Media (5.3) | 0.49% | — | 15 ago 2026 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up… |
| CVE-2026-16977 | Alta (8.1) | 0.39% | — | 12 ago 2026 | The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing… |
| CVE-2026-11777 | Media (4.9) | 0.34% | — | 18 jun 2026 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to… |
| CVE-2026-11776 | Media (4.9) | 0.34% | — | 18 jun 2026 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43 due to… |
| CVE-2026-39502 | Crítica (9.3) | 0.40% | — | 15 jun 2026 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. |
| CVE-2026-3359 | Alta (7.5) | 0.46% | — | 5 may 2026 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient… |
| CVE-2026-3330 | Media (4.9) | 0.51% | — | 17 abr 2026 | The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' parameters in all versions up to, and including,… |
| CVE-2026-4388 | Alta (7.2) | 0.40% | — | 14 abr 2026 | The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to… |
| CVE-2025-15441 | Media (6.8) | 0.27% | — | 13 abr 2026 | The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts. |
| CVE-2026-1065 | Alta (7.2) | 0.36% | — | 3 feb 2026 | The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files… |
| CVE-2025-48341 | Media (5.9) | 0.21% | — | 19 may 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through <=… |
| CVE-2024-13053 | Media (4.8) | 0.31% | — | 15 may 2025 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… |
| CVE-2024-10680 | Media (4.8) | 0.27% | — | 16 abr 2025 | The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… |
| CVE-2024-10560 | Baja (3.5) | 0.32% | — | 25 mar 2025 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… |
| CVE-2024-10558 | Baja (3.5) | 0.26% | — | 24 mar 2025 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… |
| CVE-2024-13605 | Media (4.8) | 0.36% | — | 24 feb 2025 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… |
| CVE-2024-10562 | Baja (2.7) | 0.42% | — | 7 ene 2025 | The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… |
| CVE-2024-10265 | Media (6.1) | 0.37% | — | 10 nov 2024 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in… |
| CVE-2024-8633 | Media (4.8) | 0.34% | — | 26 sept 2024 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.27 due to insufficient input… |
| CVE-2024-43220 | Media (6.1) | 0.31% | — | 12 ago 2024 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Reflected XSS.This issue affects Form Maker by 10Web: from… |
| CVE-2024-6130 | Media (4.8) | 0.44% | — | 1 jul 2024 | The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… |
| CVE-2023-48290 | Media (5.3) | 0.37% | — | 4 jun 2024 | Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20. |
| CVE-2024-34437 | Media (4.8) | 0.44% | — | 14 may 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a… |
| CVE-2024-2258 | Media (5.4) | 0.36% | — | 27 abr 2024 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name autofilled into forms in all versions up to, and… |
| CVE-2024-32534 | Media (4.8) | 0.34% | — | 17 abr 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a… |
| CVE-2024-2112 | Alta (7.5) | 0.70% | — | 9 abr 2024 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature… |
| CVE-2024-0667 | Media (6.3) | 0.23% | — | 27 ene 2024 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.15.21. This is due to missing or… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.