10web

Form Maker

41 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.2

CVE-2026-96813

  • EPSS 0.3%
  • Veröffentlicht 01.10.2026 08:28:44
  • Zuletzt bearbeitet 03.10.2026 16:16:47

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient i...

6.1

CVE-2026-85645

  • EPSS 0.22%
  • Veröffentlicht 10.09.2026 05:31:29
  • Zuletzt bearbeitet 11.09.2026 21:17:32

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sani...

5.3

CVE-2026-15993

  • EPSS 0.31%
  • Veröffentlicht 15.08.2026 03:25:57
  • Zuletzt bearbeitet 20.08.2026 12:48:10

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due t...

8.5

CVE-2026-28184

  • EPSS -
  • Veröffentlicht 13.08.2026 13:36:36
  • Zuletzt bearbeitet 14.08.2026 08:17:38

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

8.1

CVE-2026-16977

Exploit
  • EPSS 0.22%
  • Veröffentlicht 12.08.2026 06:00:15
  • Zuletzt bearbeitet 26.08.2026 16:30:52

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-o...

4.9

CVE-2026-11776

  • EPSS 0.35%
  • Veröffentlicht 18.06.2026 04:31:09
  • Zuletzt bearbeitet 18.06.2026 04:31:09

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user...

4.9

CVE-2026-11777

  • EPSS 0.35%
  • Veröffentlicht 18.06.2026 04:31:08
  • Zuletzt bearbeitet 18.06.2026 04:31:08

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user sup...

9.3

CVE-2026-39502

  • EPSS 0.29%
  • Veröffentlicht 15.06.2026 20:17:55
  • Zuletzt bearbeitet 15.06.2026 21:24:32

Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.

7.1

CVE-2018-25346

Exploit
  • EPSS 0.2%
  • Veröffentlicht 23.05.2026 18:30:48
  • Zuletzt bearbeitet 23.07.2026 16:10:00

WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submi...

7.5

CVE-2026-3359

  • EPSS 0.36%
  • Veröffentlicht 05.05.2026 09:16:03
  • Zuletzt bearbeitet 05.05.2026 19:08:20

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied para...