10web

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any 10web product.

RSS Feeds for 10web security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in 10web products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by 10web Sorted by Most Security Vulnerabilities since 2018

10web Photo Gallery48 vulnerabilities

10web Form Maker40 vulnerabilities

10web Slider13 vulnerabilities

10web Map Builder For Google Maps4 vulnerabilities

10webanalytics3 vulnerabilities

10web Social Post Feed2 vulnerabilities

10web Image Optimizer2 vulnerabilities

10web Seo2 vulnerabilities

10web Wps Telegram Chat2 vulnerabilities

10web Booster1 vulnerability

10websocial1 vulnerability

10web Ai Assistant1 vulnerability

Sliderby10web1 vulnerability

10web Spidercalendar1 vulnerability

10web Spidercontacts1 vulnerability

10web Wd Google Maps1 vulnerability

By the Year

In 2026 there have been 24 vulnerabilities in 10web with an average score of 6.6 out of ten. Last year, in 2025 10web had 17 security vulnerabilities published. That is, 7 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.10.

Year	Vulnerabilities	Average Score
2026	24	6.62
2025	17	6.52
2024	40	5.77
2023	17	6.41
2022	11	6.34
2021	8	6.50
2020	1	0.00
2019	8	8.12

It may take a day or so for new 10web vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent 10web Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-66616	Aug 20, 2026	Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions. Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions.	Form Maker
CVE-2026-66635	Aug 18, 2026	Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions. Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions.	Slider
CVE-2026-15993	Aug 15, 2026	Blind SQLi in Form Maker Plugin 10Web v1.15.44 via {username} DB Field The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that a form is configured with a DB-backed dynamic choice field whose WHERE template references the {username} placeholder, and the attacker must first set their own display_name to a SQL payload via the standard WordPress profile edit screen before triggering the fm_reload_input AJAX endpoint.	Form Maker
CVE-2026-28184	Aug 13, 2026	CVE-2026-28184	Form Maker
CVE-2026-16977	Aug 12, 2026	SQLi via Choice Field in Form Maker by 10Web WP Plugin <1.15.45 The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.	Form Maker
CVE-2026-11776	Jun 18, 2026	WordPress Form Maker <=1.15.43 SQLi via groupids (authenticated admin) The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Form Maker
CVE-2026-11777	Jun 18, 2026	SQLi Vulnerability in Form Maker <=1.15.43 via 'name' Param The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Form Maker
CVE-2026-39502	Jun 15, 2026	Unauthenticated SQLi in 10Web Form Maker <=1.15.38 Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.	Form Maker
CVE-2016-20074	Jun 15, 2026	CVE-2016-20074 WordPress LCS Plugin 3.4 CSRF via lzcs_admin.php WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs_admin.php to modify plugin configuration parameters like lzcs_color and lzcs_count.	Slider
CVE-2026-9829	Jun 06, 2026	WordPress 10Web Photo Gallery <=1.8.41 Time-Based SQLi via compact_album_order_by The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.	Photo Gallery
CVE-2019-25745	Jun 04, 2026	Google Review Slider 6.1: Time-based Blind SQLi via 'tid' WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.	Slider
CVE-2026-49771	Jun 04, 2026	10Web Photo Gallery <=1.8.41 Blind SQLi Vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.	Photo Gallery
CVE-2026-7048	May 28, 2026	Photo Gallery by 10Web: SQL Injection via order_by up to 1.8.40 The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.8.40 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable by embedding a malicious shortcode in a post or draft, allowing the injected SQL to execute when the shortcode is rendered.	Photo Gallery
CVE-2018-25346	May 23, 2026	WordPress Form Maker Plugin <=1.12.24 SQLi via FormMakerSQLMapping Action WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.	Form Maker
CVE-2020-37227	May 16, 2026	HS Brand Logo Slider 2.1 Unrestricted File Upload via logoupload HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can intercept upload requests to the logoupload parameter in the admin interface and rename files to executable extensions .php to achieve remote code execution.	Slider
CVE-2026-3359	May 05, 2026	SQLi via 'inputs' param in 10Web Form Maker <=1.15.42 The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Form Maker
CVE-2026-3330	Apr 17, 2026	SQL Injection in The Form Maker WP Plugin v1.15.40 via unsanitized params The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' parameters in all versions up to, and including, 1.15.40. This is due to the `WDW_FM_Library::validate_data()` method calling `stripslashes()` on user input (removing WordPress's `wp_magic_quotes()` protection) and the `FMModelSubmissions_fm::get_labels_parameters()` function directly concatenating user-supplied values into SQL queries without using `$wpdb->prepare()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the Submissions controller skips nonce verification for the `display` task, which means this vulnerability can be triggered via CSRF by tricking an administrator into clicking a crafted link.	Form Maker
CVE-2026-4388	Apr 14, 2026	Form Maker by 10Web WP Plugin <=1.15.40 Stored XSS via Matrix Field (Text Box) The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization (`sanitize_text_field` strips tags but not quotes) and missing output escaping when rendering submission data in the admin Submissions view. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript through a form submission that executes in the browser of an administrator who views the submission details.	Form Maker
CVE-2025-15441	Apr 13, 2026	SQL Injection via MySQL Mapping in Form Maker by 10Web (<1.15.38) The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.	Form Maker
CVE-2026-32330	Mar 13, 2026	10Web Photo Gallery <=1.8.37 CSRF Vulnerability Cross-Site Request Forgery (CSRF) vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Cross Site Request Forgery.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.37.	Photo Gallery
CVE-2026-27360	Feb 19, 2026	10Web Photo Gallery <=1.8.37 Stored XSS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.38.	Photo Gallery
CVE-2026-1058	Feb 03, 2026	Stored XSS in Form Maker 1.15.35 via hidden fields The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions list.	Form Maker
CVE-2026-1065	Feb 03, 2026	Form Maker wp plugin stored XSS via SVG upload 1.15.35 The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.	Form Maker
CVE-2026-1036	Jan 21, 2026	Unauth Delete via delete_comment() in 10Web Photo Gallery 1.8.36 The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to delete arbitrary image comments. Note: comments functionality is only available in the Pro version of the plugin.	Photo Gallery
CVE-2025-13377	Dec 06, 2025	10Web Booster 2.32.7: Arbitrary Folder Deletion via get_cache_dir() The 10Web Booster Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
CVE-2020-36853	Oct 18, 2025	10WebMapBuilder 1.0.63: Stored XSS via Settings Change The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-48341	May 19, 2025	10Web Form Maker: Stored XSS in 10W Form Maker up to 1.15.33 (CVE-2025-48341) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web allows Stored XSS. This issue affects Form Maker by 10Web: from n/a through 1.15.33.	Form Maker
CVE-2024-13053	May 15, 2025	10Web Form Maker XSS before 1.15.33 The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2024-8670	May 15, 2025	Photo Gallery by 10Web WP plugin <1.8.29: Stored XSS via unsanitized settings The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Photo Gallery
CVE-2024-10680	Apr 16, 2025	Form Maker 10Web WP Plugin <1.15.32: Stored XSS via unsanitised settings The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2025-2269	Apr 12, 2025	XSS via image_id in Photo Gallery by 10Web WP plugin up to 1.8.34 The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the image_id parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.	Photo Gallery
CVE-2025-0613	Mar 31, 2025	10Web Photo Gallery WP Plugin XSS before 1.8.34 Unauthenticated Stored-XSS The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed	Photo Gallery
CVE-2024-10566	Mar 25, 2025	XSS via unsanitised settings in Slider by 10Web WP plugin <1.2.62 The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Slider
CVE-2024-10565	Mar 25, 2025	Stored XSS in 10Web Slider WP Plugin before 1.2.62 The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Slider
CVE-2024-10560	Mar 25, 2025	WP 10Web Form Maker <1.15.30 Unsanitised Settings XSS The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2024-13124	Mar 24, 2025	Stored XSS in 10Web PhotoGallery WP plugin before 1.8.33 The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Photo Gallery
CVE-2024-10558	Mar 24, 2025	WordPress Form Maker <=1.15.30 XSS via Unsanitised Settings The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2024-13605	Feb 24, 2025	Form Maker WP Plugin <1.15.33 Vulnerable to Stored XSS The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2024-10562	Jan 07, 2025	10Web Form Maker WP Plugin 1.15.31 XSS via unsanitized settings The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2023-45272	Jan 02, 2025	Missing Auth in 10Web Map Builder for Google Maps (<=1.0.73) Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps wd-google-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10Web Map Builder for Google Maps: from n/a through <= 1.0.73.	Map Builder For Google Maps Wd Google Maps
CVE-2023-47807	Jan 02, 2025	10WebAnalytics v1.2.12 Missing Auth: access control flaw Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10WebAnalytics: from n/a through <= 1.2.12.	10webanalytics
CVE-2023-33995	Dec 13, 2024	Missing Auth in Photo Gallery by 10Web <1.8.15, Access Control Bypass Missing Authorization vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.15.	Photo Gallery
CVE-2024-5020	Dec 04, 2024	WordPress Plugins Stored XSS Vulnerability in FancyBox JavaScript Library Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Form Maker
CVE-2024-10704	Nov 29, 2024	Stored XSS Vulnerability in Photo Gallery by 10Web WordPress Plugin The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Photo Gallery
CVE-2024-10265	Nov 10, 2024	Form Maker by 10Web XSS via add_query_arg The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	Form Maker
CVE-2024-9878	Nov 05, 2024	10Web Gallery XSS in Admin Settings The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	Photo Gallery
CVE-2024-9628	Oct 25, 2024	WPS Telegram Chat v4.5.4 Unauthorized Data Modification via Missing Capability Check The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Telegram_Chat_Admin::check?onnection' function in versions up to, and including, 4.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the Telegram Bot API endpoint and communicate with it.	Wps Telegram Chat
CVE-2024-9630	Oct 25, 2024	WPS Telegram Chat <=4.5.4 Auth Bypass via Capability Check Missing The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.5.4. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API.	Wps Telegram Chat
CVE-2024-9607	Oct 25, 2024	10Web Social Post Feed v1.2.9 XSS via add_query_arg The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this is only exploitable when the leave a review notice is present.	10web Social Post Feed
CVE-2024-5968	Oct 09, 2024	XSS via Gallery settings in The Photo Gallery by 10Web v<1.8.28 The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	Photo Gallery