10web
57 CVEs across 30 10web products. Browse 10web vulnerabilities, severities, and proof-of-concept exploits.
10web products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15993 | Medium | 5.3 | 2026-08-15 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placehold… |
CVE-2026-11777 | Medium | 4.9 | 2026-06-18 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter… |
CVE-2026-11776 | Medium | 4.9 | 2026-06-18 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' param… |
CVE-2026-39502 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. |
CVE-2026-9829 | Medium | 6.5 | 2026-06-06 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcod… |
CVE-2026-49771 | High | 7.6 | 2026-06-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. … |
CVE-2026-7048 | Medium | 6.5 | 2026-05-28 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order_by' parameter in… |
CVE-2018-25346 | High | 7.1 | 2026-05-23 | WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injec… |
CVE-2026-3359 | High | 7.5 | 2026-05-05 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in ve… |
CVE-2026-3330 | Medium | 4.9 | 2026-04-17 | The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_sear… |
CVE-2026-4388 | High | 7.2 | 2026-04-14 | The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all… |
CVE-2026-32330 | Medium | 4.3 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Cross Site Request Forgery.This issue affects Photo Galler… |
CVE-2026-27360 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored… |
CVE-2026-1065 | High | 7.2 | 2026-02-03 | The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plu… |
CVE-2026-1058 | High | 7.1 | 2026-02-03 | The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is… |
CVE-2026-1036 | Medium | 5.3 | 2026-01-22 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2025-13377 | Critical | 9.6 | 2025-12-06 | The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficien… |
CVE-2020-36853 | High | 7.2 | 2025-10-18 | The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due t… |
CVE-2025-48341 | Medium | 5.9 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.Th… |
CVE-2024-8670 | Medium | 4.8 | 2025-05-15 | The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-13053 | Medium | 4.8 | 2025-05-15 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-10680 | Medium | 4.8 | 2025-04-16 | The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2025-2269 | Medium | 6.1 | 2025-04-12 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in… |
CVE-2025-0613 | Medium | 6.1 | 2025-03-31 | The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unaut… |
CVE-2024-10566 | Medium | 6.1 | 2025-03-25 | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10565 | Medium | 6.1 | 2025-03-25 | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10560 | Low | 3.5 | 2025-03-25 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-13124 | Low | 3.5 | 2025-03-24 | The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-10558 | Low | 3.5 | 2025-03-24 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-13605 | Medium | 4.8 | 2025-02-24 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-10562 | Low | 2.7 | 2025-01-07 | The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2023-47807 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2023-45272 | Medium | 5.4 | 2025-01-02 | Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2023-33995 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-5020 | Medium | 6.4 | 2024-12-04 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in… |
CVE-2024-10704 | Medium | 4.8 | 2024-11-29 | The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-10265 | Medium | 6.1 | 2024-11-10 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use… |
CVE-2024-9878 | Medium | 4.4 | 2024-11-05 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions… |
CVE-2024-9630 | Medium | 5.4 | 2024-10-25 | The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, a… |
CVE-2024-9628 | Medium | 6.3 | 2024-10-25 | The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Te… |
CVE-2024-9607 | Medium | 6.1 | 2024-10-25 | The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on… |
CVE-2024-5968 | Medium | 4.8 | 2024-10-09 | The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege… |
CVE-2024-44043 | Medium | 5.9 | 2024-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored… |
CVE-2024-8283 | Medium | 4.8 | 2024-09-30 | The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-8633 | Medium | 5.5 | 2024-09-26 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up… |
CVE-2024-43220 | High | 7.1 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows… |
CVE-2024-7150 | High | 8.8 | 2024-08-08 | The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and… |
CVE-2024-6408 | Medium | 5.4 | 2024-07-31 | The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and a… |
CVE-2024-6272 | Medium | 6.1 | 2024-07-31 | The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2024-6026 | Medium | 5.4 | 2024-07-11 | The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access t… |
CVE-2024-6130 | Medium | 4.8 | 2024-07-01 | The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-35628 | Medium | 4.3 | 2024-06-11 | Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.25. |
CVE-2024-5481 | Medium | 6.8 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 vi… |
CVE-2024-5426 | Medium | 6.4 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all ver… |
CVE-2023-48290 | Medium | 5.3 | 2024-06-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue a… |
CVE-2024-34437 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored… |
CVE-2024-33586 | Medium | 5.3 | 2024-04-29 | Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.20. |
CVE-2024-2258 | Medium | 4.4 | 2024-04-27 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's displ… |
CVE-2024-32583 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Reflecte… |
CVE-2024-32578 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Slider by 10Web allows Reflected XSS.This issue aff… |
CVE-2024-32534 | Medium | 5.9 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored… |
CVE-2024-2112 | Medium | 5.9 | 2024-04-09 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2024-2296 | Medium | 5.5 | 2024-04-06 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versio… |
CVE-2024-31116 | High | 7.6 | 2024-03-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web 10Web Map Builder for Google Maps.This issue affect… |
CVE-2024-29833 | Medium | 5.4 | 2024-03-26 | The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which… |
CVE-2024-29832 | Medium | 6.1 | 2024-03-26 | The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current… |
CVE-2024-29810 | Medium | 5.4 | 2024-03-26 | The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_… |
CVE-2024-29809 | Medium | 5.4 | 2024-03-26 | The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_… |
CVE-2024-29808 | Medium | 5.4 | 2024-03-26 | The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_i… |
CVE-2024-0221 | Critical | 9.1 | 2024-02-05 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8… |
CVE-2023-6985 | Medium | 6.5 | 2024-02-05 | The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-0667 | Medium | 5.4 | 2024-01-27 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2023-6924 | Medium | 4.4 | 2024-01-11 | The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insuff… |
CVE-2023-5559 | Critical | 9.1 | 2023-11-27 | The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitr… |
CVE-2023-5048 | Medium | 6.4 | 2023-11-22 | The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versions up to, and incl… |
CVE-2023-34375 | High | 7.1 | 2023-11-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web SEO by 10Web plugin <= 1.2.9 versions. |
CVE-2023-5709 | High | 8.8 | 2023-11-07 | The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 due to insufficient… |
CVE-2023-45071 | High | 7.1 | 2023-10-18 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi… |
CVE-2023-45070 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder pl… |
CVE-2023-4666 | Critical | 9.8 | 2023-10-16 | The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated… |
CVE-2023-2122 | Medium | 6.1 | 2023-08-16 | The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin… |
CVE-2020-36756 | Medium | 4.3 | 2023-07-12 | The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to missing or incorrec… |
CVE-2021-46889 | Medium | 6.1 | 2023-06-07 | The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291… |
CVE-2023-2503 | Medium | 6.1 | 2023-06-05 | The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflecte… |
CVE-2023-2224 | Medium | 4.8 | 2023-06-05 | The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2023-2117 | Low | 2.7 | 2023-05-30 | The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high priv… |
CVE-2023-1427 | Medium | 4.9 | 2023-04-17 | - The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege user… |
CVE-2023-0037 | Critical | 9.8 | 2023-03-13 | The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statemen… |
CVE-2022-4758 | Medium | 5.4 | 2023-01-23 | The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4197 | Medium | 4.8 | 2022-12-26 | The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-4058 | Medium | 5.4 | 2022-12-19 | The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in ano… |
CVE-2021-31693 | Medium | 6.1 | 2022-11-29 | The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: othe… |
CVE-2022-3300 | High | 7.2 | 2022-10-25 | The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL i… |
CVE-2022-1394 | Medium | 4.8 | 2022-06-08 | The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users suc… |
CVE-2022-1564 | Medium | 4.8 | 2022-05-30 | The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as ad… |
CVE-2022-1320 | Medium | 4.8 | 2022-05-23 | The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as ad… |
CVE-2022-1282 | Medium | 6.1 | 2022-05-02 | The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when… |
CVE-2022-1281 | Critical | 9.8 | 2022-05-02 | The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Inj… |
CVE-2022-0169 | Critical | 9.8 | 2022-03-14 | The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statem… |
CVE-2022-0212 | Medium | 6.1 | 2022-02-14 | The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJA… |