Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

49 results

Oct 14, 2026SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications: Privilege EscalationCVE-2026-104748 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
Product
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Blind SQL InjectionCVE-2026-95808 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.48
What to do
Affects up to 1.15.48. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Reflected Cross-Site ScriptingCVE-2026-103998 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to, and including, 1.15.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.48
What to do
Affects up to 1.15.48. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Stored Cross-Site ScriptingCVE-2026-96813 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.47
What to do
Affects up to 1.15.47. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Reflected Cross-Site ScriptingCVE-2026-85645 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.46
What to do
Affects up to 1.15.46. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Aug 20, 2026Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.
Product
Form Maker by 10Web
Affected
up to 1.15.49
What to do
Affects up to 1.15.49. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 15, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Blind SQL InjectionCVE-2026-15993 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that a form is configured with a DB-backed dynamic choice field whose WHERE template references the {username} placeholder, and the attacker must first set their own display_name to a SQL payload via the standard WordPress profile edit screen before triggering the fm_reload_input AJAX endpoint.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.44
What to do
Affects up to 1.15.44. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2026Form Maker by 10Web: Does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice fieldCVE-2026-16977 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
Product
Form Maker by 10Web
Fixed in
1.15.45
What to do
Update Form Maker by 10Web to 1.15.45 or newer.
Full record and what to do →NVD record wpscan.com
Jun 18, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Generic SQL InjectionCVE-2026-11777 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.43
What to do
Affects up to 1.15.43. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Generic SQL InjectionCVE-2026-11776 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.43
What to do
Affects up to 1.15.43. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 15, 2026Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.CVE-2026-39502 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.
Affected
up to 1.15.38
What to do
Affects up to 1.15.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2026WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through theCVE-2018-25347 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 23, 2026WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injectCVE-2018-25346 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com vulncheck.com
May 5, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: SQL InjectionCVE-2026-3359 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.42
What to do
Affects up to 1.15.42. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 17, 2026Form Maker by 10Web: SQL InjectionCVE-2026-3330 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' parameters in all versions up to, and including, 1.15.40. This is due to the `WDW_FM_Library::validate_data()` method calling `stripslashes()` on user input (removing WordPress's `wp_magic_quotes()` protection) and the `FMModelSubmissions_fm::get_labels_parameters()` function directly concatenating user-supplied values into SQL queries without using `$wpdb->prepare()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the Submissions controller skips nonce verification for the `display` task, which means this vulnerability can be triggered via CSRF by tricking an administrator into clicking a crafted link.
Product
Form Maker by 10Web
Affected
up to 1.15.40
What to do
Affects up to 1.15.40. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 13, 2026Form Maker by 10Web: Stored Cross-Site ScriptingCVE-2026-4388 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization (`sanitize_text_field` strips tags but not quotes) and missing output escaping when rendering submission data in the admin Submissions view. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript through a form submission that executes in the browser of an administrator who views the submission details.
Product
Form Maker by 10Web
Affected
up to 1.15.40
What to do
Affects up to 1.15.40. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 13, 2026Form Maker by 10Web: Does not properly prepare SQL queriesCVE-2025-15441 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.
Product
Form Maker by 10Web
Fixed in
1.15.38
What to do
Update Form Maker by 10Web to 1.15.38 or newer.
Full record and what to do →NVD record wpscan.com
Feb 3, 2026Form Maker by 10Web: Stored Cross-Site ScriptingCVE-2026-1065 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.
Product
Form Maker by 10Web
Affected
up to 1.15.35
What to do
Affects up to 1.15.35. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 3, 2026Form Maker: Stored Cross-Site ScriptingCVE-2026-1058 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions list.
Product
Form Maker
Affected
up to 1.15.35
What to do
Affects up to 1.15.35. Update Form Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2025Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48341 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through <= 1.15.33.
Product
Form Maker by 10Web
Affected
up to 1.15.33
What to do
Affects up to 1.15.33. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13053 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.33
What to do
Update Form Maker by 10Web to 1.15.33 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 16, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10680 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.32
What to do
Update Form Maker by 10Web to 1.15.32 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10560 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.30
What to do
Update Form Maker by 10Web to 1.15.30 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10558 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.30
What to do
Update Form Maker by 10Web to 1.15.30 or newer.
Full record and what to do →NVD record wpscan.com
Feb 24, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.33
What to do
Update Form Maker by 10Web to 1.15.33 or newer.
Full record and what to do →NVD record wpscan.com
Jan 7, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10562 · WordPress plugins & themes · reported by WPScanLow 2.7
The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.31
What to do
Update Form Maker by 10Web to 1.15.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 6, 2025Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce: Stored Cross-Site ScriptingCVE-2024-11934 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' shortcode in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce
Affected
up to 2.1.3.2
What to do
Affects up to 2.1.3.2. Update Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Reflected Cross-Site ScriptingCVE-2024-10265 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.30
What to do
Affects up to 1.15.30. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Stored Cross-Site ScriptingCVE-2024-8633 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.27
What to do
Affects up to 1.15.27. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 12, 2024Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43220 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Reflected XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.26.
Product
Form Maker by 10Web
Affected
up to 1.15.26
What to do
Affects up to 1.15.26. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 1, 2024Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-6130 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Form Maker by 10Web
Fixed in
1.15.26
What to do
Update Form Maker by 10Web to 1.15.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks: Stored Cross-Site ScriptingCVE-2024-4042 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the menu-wrap-item block in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Affected
up to 2.2.80
What to do
Affects up to 2.2.80. Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 7, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks: Stored Cross-Site ScriptingCVE-2024-1988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute in blocks in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Affected
up to 2.2.80
What to do
Affects up to 2.2.80. Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 4, 2024Form Maker by 10Web: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48290 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20.
Product
Form Maker by 10Web
Affected
up to 1.15.20
What to do
Affects up to 1.15.20. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 20, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks: Stored Cross-Site ScriptingCVE-2024-3155 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Affected
up to 2.2.80
What to do
Affects up to 2.2.80. Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34437 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.24.
Product
Form Maker by 10Web
Affected
up to 1.15.24
What to do
Affects up to 1.15.24. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 27, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Stored Cross-Site ScriptingCVE-2024-2258 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name autofilled into forms in all versions up to, and including, 1.15.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.24
What to do
Affects up to 1.15.24. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 17, 2024Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32534 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.23.
Product
Form Maker by 10Web
Affected
up to 1.15.23
What to do
Affects up to 1.15.23. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel: Does not have proper authorizationCVE-2024-0881 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel
Fixed in
2.2.76
What to do
Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel to 2.2.76 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 9, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Sensitive Information ExposureCVE-2024-2112 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature functionality. This makes it possible for unauthenticated attackers to extract sensitive data including user signatures.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.22
What to do
Affects up to 1.15.22. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Cross-Site Request ForgeryCVE-2024-0667 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.15.21. This is due to missing or incorrect nonce validation on the 'execute' function. This makes it possible for unauthenticated attackers to execute arbitrary methods in the 'BoosterController' class via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.21
What to do
Affects up to 1.15.21. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023Form Maker by 10Web: Does not validate signaturesCVE-2023-4666 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
Product
Form Maker by 10Web
Fixed in
1.15.20
What to do
Update Form Maker by 10Web to 1.15.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2022Form Maker by 10Web: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3300 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Form Maker by 10Web
Fixed in
1.15.6
What to do
Update Form Maker by 10Web to 1.15.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022Form Maker by 10Web: Does not sanitize and escape the Custom Text settingsCVE-2022-1564 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Form Maker by 10Web
Fixed in
1.14.12
What to do
Update Form Maker by 10Web to 1.14.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Does not escape its Form Title before outputting it in an attributeCVE-2021-24526 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Fixed in
1.13.60
What to do
Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to 1.13.60 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2019The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.CVE-2019-17072 · WordPress plugins & themes · reported by MITRECritical 9.8
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
Affected
1.0.9 to 1.0.9
What to do
Affects 1.0.9 to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordpress.org
May 23, 2019In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/CVE-2019-10866 · WordPress plugins & themes · reported by MITRECritical 9.8
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
Product
In the Form Maker
Fixed in
1.13.3
What to do
Update In the Form Maker to 1.13.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Apr 29, 2019The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via diCVE-2019-11590 · WordPress plugins & themes · reported by MITREHigh 8.8
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
10Web Form Maker
Fixed in
1.13.5
What to do
Update 10Web Form Maker to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 27, 2018The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.CVE-2018-10504 · WordPress plugins & themes · reported by MITREHigh 7.8
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
Product
WebDorado "Form Maker by WD
Fixed in
1.12.24
What to do
Update WebDorado "Form Maker by WD to 1.12.24 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.