CVE-2026-66616 is a high-severity stored cross-site scripting (XSS) vulnerability in 10Web Form Maker by 10Web. It affects versions from the initial release up to and including 1.15.49. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in users' browsers. This can lead to partial confidentiality, integrity, and availability impacts. No patch or official fix information is provided in the available data.
CVE-2026-66635 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the 10Web Slider plugin up to version 1.2.63. This vulnerability allows an attacker to induce an authenticated user to perform unwanted actions on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.4. No patch or official fix information is provided in the available data.
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that a form is configured with a DB-backed dynamic choice field whose WHERE template references the {username} placeholder, and the attacker must first set their own display_name to a SQL payload via the standard WordPress profile edit screen before triggering the fm_reload_input AJAX endpoint.
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin is vulnerable to a time-based SQL Injection via the 'compact_album_order_by' shortcode parameter in all versions up to and including 1.8.41. This vulnerability allows authenticated users with contributor-level access or higher to inject additional SQL queries due to insufficient escaping and lack of query preparation. The malicious payload is stored through an AJAX handler accessible to contributors without requiring a valid nonce and can be triggered by an unauthenticated AJAX handler, enabling exploitation with only contributor-level access.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection.
This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.8.40 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable by embedding a malicious shortcode in a post or draft, allowing the injected SQL to execute when the shortcode is rendered.
CVE-2026-3359 is a high-severity SQL Injection vulnerability in the Form Maker by 10Web WordPress plugin, affecting versions up to 1.15.42. The vulnerability arises from improper sanitization of the 'inputs' parameter, allowing unauthenticated attackers to inject additional SQL queries. This can lead to unauthorized extraction of sensitive database information. No official patch or remediation guidance is currently confirmed. The vulnerability has a CVSS score of 7.5, indicating a significant risk if exploited.
The Form Maker by 10Web WordPress plugin up to version 1.15.40 contains an SQL Injection vulnerability in several parameters due to improper input handling and lack of prepared statements. Authenticated administrators can exploit this to append SQL queries and extract sensitive database information. The vulnerability can also be triggered via CSRF because nonce verification is skipped for a specific controller task. The CVSS score is 4.9, indicating medium severity.
CVE-2026-4388 is a stored cross-site scripting (XSS) vulnerability in the Form Maker by 10Web WordPress plugin, affecting all versions up to and including 1.15.40. The vulnerability arises from insufficient input sanitization and missing output escaping in the admin Submissions view, allowing unauthenticated attackers to inject arbitrary JavaScript via form submissions. This malicious script executes in the browser of an administrator who views the submission details. The vulnerability has a high severity score of 7.2 and does not currently have an official patch or remediation guidance from the vendor.
Cross-Site Request Forgery (CSRF) vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Cross Site Request Forgery.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.37.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.38.
The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions list.
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to delete arbitrary image comments. Note: comments functionality is only available in the Pro version of the plugin.
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.