10web

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any 10web product.

RSS Feeds for 10web security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in 10web products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by 10web Sorted by Most Security Vulnerabilities since 2018

10web Photo Gallery53 vulnerabilities

10web Form Maker43 vulnerabilities

10web Slider15 vulnerabilities

10web Map Builder For Google Maps4 vulnerabilities

10webanalytics3 vulnerabilities

10web Seo2 vulnerabilities

10web Wps Telegram Chat2 vulnerabilities

10web Image Optimizer2 vulnerabilities

10web Social Post Feed2 vulnerabilities

10web Ai Assistant1 vulnerability

10web Booster1 vulnerability

10websocial1 vulnerability

Sliderby10web1 vulnerability

10web Spidercalendar1 vulnerability

10web Spidercontacts1 vulnerability

10web Tenweb Speed Optimizer1 vulnerability

10web Wd Google Maps1 vulnerability

10web Wd Instagram Feed1 vulnerability

By the Year

In 2026 there have been 36 vulnerabilities in 10web with an average score of 6.7 out of ten. Last year, in 2025 10web had 17 security vulnerabilities published. That is, 19 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.20.

Year	Vulnerabilities	Average Score
2026	36	6.72
2025	17	6.52
2024	40	5.77
2023	17	6.41
2022	11	6.34
2021	8	6.50
2020	1	0.00
2019	8	8.12

It may take a day or so for new 10web vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent 10web Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-18557	Oct 15, 2026	10Web Photo Gallery WP Plugin XSS via title param (1.8.42) The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	Photo Gallery
CVE-2026-95808	Oct 14, 2026	Blind SQLi in 10Web Form Maker <=1.15.48 via 'inputs' param The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.	Form Maker
CVE-2026-42715	Oct 10, 2026	10Web Photo Gallery <=1.8.47 XSS Vulnerability Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.	Photo Gallery
CVE-2026-42711	Oct 10, 2026	Unauthenticated XSS in Slider by 10Web <=1.2.63 Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.	Slider
CVE-2026-42710	Oct 07, 2026	SQL Injection in 10Web Slider WD <=1.2.63 (Blind) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63.	Slider
CVE-2026-39787	Oct 06, 2026	Unauthenticated Broken Access Control in 10Web Social Photo Feed <=1.4.35 Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.	Wd Instagram Feed
CVE-2026-92974	Oct 03, 2026	10Web Photo Gallery 1.8.46 Reflected XSS via thumb_url The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the authenticated victim holds the manage_options capability, as the editimage_bwg AJAX action performs a capability check but no nonce verification, meaning the payload can be delivered via a crafted GET request without a CSRF token.	Photo Gallery
CVE-2026-96813	Oct 01, 2026	10Web Form Maker <=1.15.47 XSS via Map Lat/Long Fields The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Form Maker
CVE-2026-94121	Sep 30, 2026	PHP Object Injection in 10Web Booster <=2.33.6 10Web Booster Cache Optimizer Contributor PHP Object Injection in 10Web Booster Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.	Tenweb Speed Optimizer
CVE-2026-85652	Sep 18, 2026	Photo Gallery by 10Web Plugin 1.8.44 Time-Based SQLi via album_id Shortcode The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An Author-level user can store a SQL injection payload inside a published post's shortcode attribute, causing the payload to execute when any visitor renders the post; notably, the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time-based delay.	Photo Gallery
CVE-2026-86311	Sep 17, 2026	Photo Gallery WP Plugin XSS via Shortcode Args before 1.8.44 The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Photo Gallery
CVE-2026-85645	Sep 10, 2026	Form Maker <=1.15.46: Reflected XSS via bulk_action The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	Form Maker
CVE-2026-66616	Aug 20, 2026	Unauthenticated XSS in 10Web Form Maker <=1.15.46 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.	Form Maker
CVE-2026-66635	Aug 18, 2026	WP Slider by 10Web <=1.2.62 CSRF Vulnerability Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63.	Slider
CVE-2026-15993	Aug 15, 2026	Blind SQLi in Form Maker Plugin 10Web v1.15.44 via {username} DB Field The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that a form is configured with a DB-backed dynamic choice field whose WHERE template references the {username} placeholder, and the attacker must first set their own display_name to a SQL payload via the standard WordPress profile edit screen before triggering the fm_reload_input AJAX endpoint.	Form Maker
CVE-2026-28184	Aug 13, 2026	CVE-2026-28184	Form Maker
CVE-2026-16977	Aug 12, 2026	SQLi via Choice Field in Form Maker by 10Web WP Plugin <1.15.45 The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.	Form Maker
CVE-2026-11776	Jun 18, 2026	WordPress Form Maker <=1.15.43 SQLi via groupids (authenticated admin) The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Form Maker
CVE-2026-11777	Jun 18, 2026	SQLi Vulnerability in Form Maker <=1.15.43 via 'name' Param The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Form Maker
CVE-2026-39502	Jun 15, 2026	Unauthenticated SQLi in 10Web Form Maker <=1.15.38 Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.	Form Maker
CVE-2016-20074	Jun 15, 2026	CVE-2016-20074 WordPress LCS Plugin 3.4 CSRF via lzcs_admin.php WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs_admin.php to modify plugin configuration parameters like lzcs_color and lzcs_count.	Slider
CVE-2026-9829	Jun 06, 2026	WordPress 10Web Photo Gallery <=1.8.41 Time-Based SQLi via compact_album_order_by The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.	Photo Gallery
CVE-2019-25745	Jun 04, 2026	Google Review Slider 6.1: Time-based Blind SQLi via 'tid' WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.	Slider
CVE-2026-49771	Jun 04, 2026	10Web Photo Gallery <=1.8.41 Blind SQLi Vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.	Photo Gallery
CVE-2026-7048	May 28, 2026	Photo Gallery by 10Web: SQL Injection via order_by up to 1.8.40 The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.8.40 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable by embedding a malicious shortcode in a post or draft, allowing the injected SQL to execute when the shortcode is rendered.	Photo Gallery
CVE-2018-25346	May 23, 2026	WordPress Form Maker Plugin <=1.12.24 SQLi via FormMakerSQLMapping Action WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.	Form Maker
CVE-2020-37227	May 16, 2026	HS Brand Logo Slider 2.1 Unrestricted File Upload via logoupload HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can intercept upload requests to the logoupload parameter in the admin interface and rename files to executable extensions .php to achieve remote code execution.	Slider
CVE-2026-3359	May 05, 2026	SQLi via 'inputs' param in 10Web Form Maker <=1.15.42 The Form Maker by 10Web Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Form Maker
CVE-2026-3330	Apr 17, 2026	SQL Injection in The Form Maker WP Plugin v1.15.40 via unsanitized params The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' parameters in all versions up to, and including, 1.15.40. This is due to the `WDW_FM_Library::validate_data()` method calling `stripslashes()` on user input (removing WordPress's `wp_magic_quotes()` protection) and the `FMModelSubmissions_fm::get_labels_parameters()` function directly concatenating user-supplied values into SQL queries without using `$wpdb->prepare()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the Submissions controller skips nonce verification for the `display` task, which means this vulnerability can be triggered via CSRF by tricking an administrator into clicking a crafted link.	Form Maker
CVE-2026-4388	Apr 14, 2026	Form Maker by 10Web WP Plugin <=1.15.40 Stored XSS via Matrix Field (Text Box) The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization (`sanitize_text_field` strips tags but not quotes) and missing output escaping when rendering submission data in the admin Submissions view. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript through a form submission that executes in the browser of an administrator who views the submission details.	Form Maker
CVE-2025-15441	Apr 13, 2026	SQL Injection via MySQL Mapping in Form Maker by 10Web (<1.15.38) The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.	Form Maker
CVE-2026-32330	Mar 13, 2026	10Web Photo Gallery <=1.8.37 CSRF Vulnerability Cross-Site Request Forgery (CSRF) vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Cross Site Request Forgery.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.37.	Photo Gallery
CVE-2026-27360	Feb 19, 2026	10Web Photo Gallery <=1.8.37 Stored XSS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.38.	Photo Gallery
CVE-2026-1058	Feb 03, 2026	Stored XSS in Form Maker 1.15.35 via hidden fields The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions list.	Form Maker
CVE-2026-1065	Feb 03, 2026	Form Maker wp plugin stored XSS via SVG upload 1.15.35 The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.	Form Maker
CVE-2026-1036	Jan 21, 2026	Unauth Delete via delete_comment() in 10Web Photo Gallery 1.8.36 The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to delete arbitrary image comments. Note: comments functionality is only available in the Pro version of the plugin.	Photo Gallery
CVE-2025-13377	Dec 06, 2025	10Web Booster 2.32.7: Arbitrary Folder Deletion via get_cache_dir() The 10Web Booster Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
CVE-2020-36853	Oct 18, 2025	10WebMapBuilder 1.0.63: Stored XSS via Settings Change The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-48341	May 19, 2025	10Web Form Maker: Stored XSS in 10W Form Maker up to 1.15.33 (CVE-2025-48341) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web allows Stored XSS. This issue affects Form Maker by 10Web: from n/a through 1.15.33.	Form Maker
CVE-2024-13053	May 15, 2025	10Web Form Maker XSS before 1.15.33 The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2024-8670	May 15, 2025	Photo Gallery by 10Web WP plugin <1.8.29: Stored XSS via unsanitized settings The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Photo Gallery
CVE-2024-10680	Apr 16, 2025	Form Maker 10Web WP Plugin <1.15.32: Stored XSS via unsanitised settings The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2025-2269	Apr 12, 2025	XSS via image_id in Photo Gallery by 10Web WP plugin up to 1.8.34 The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the image_id parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.	Photo Gallery
CVE-2025-0613	Mar 31, 2025	10Web Photo Gallery WP Plugin XSS before 1.8.34 Unauthenticated Stored-XSS The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed	Photo Gallery
CVE-2024-10566	Mar 25, 2025	XSS via unsanitised settings in Slider by 10Web WP plugin <1.2.62 The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Slider
CVE-2024-10565	Mar 25, 2025	Stored XSS in 10Web Slider WP Plugin before 1.2.62 The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Slider
CVE-2024-10560	Mar 25, 2025	WP 10Web Form Maker <1.15.30 Unsanitised Settings XSS The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2024-10558	Mar 24, 2025	WordPress Form Maker <=1.15.30 XSS via Unsanitised Settings The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker
CVE-2024-13124	Mar 24, 2025	Stored XSS in 10Web PhotoGallery WP plugin before 1.8.33 The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Photo Gallery
CVE-2024-13605	Feb 24, 2025	Form Maker WP Plugin <1.15.33 Vulnerable to Stored XSS The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Form Maker