Vulnerabilities in 10web
74 resultsCVE-2026-95808HIGHForm Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' ParameterEPSS 0.4%CVE-2024-2296MEDIUMPhoto Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVGEPSS 0.4%CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2024-29833MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandlerEPSS 0.4%CVE-2026-3330MEDIUMForm Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' ParameterEPSS 0.4%CVE-2024-29808MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_idEPSS 0.4%CVE-2024-29809MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_urlEPSS 0.4%CVE-2024-29810MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg thumb_urlEPSS 0.4%CVE-2023-34375HIGHWordPress Seo By 10Web Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-10265MEDIUMForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg ParameterEPSS 0.4%CVE-2020-36756MEDIUM10WebAnalytics <= 1.2.8 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2026-85645MEDIUMForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2020-36853HIGH10WebMapBuilder <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings ChangeEPSS 0.4%CVE-2026-1065HIGHForm Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG fileEPSS 0.4%CVE-2026-118081HIGHWordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-94121HIGHWordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-1058HIGHForm Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden FieldEPSS 0.4%CVE-2026-3359HIGHForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'EPSS 0.4%CVE-2024-2258MEDIUMForm Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site ScriptingEPSS 0.4%CVE-2026-11776MEDIUMForm Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' ParameterEPSS 0.3%