10Web vulnerabilities
We track 26 vulnerabilities in 10Web products across 15 products. 26 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest 10Web vulnerabilities
- 7.1 High severity
Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50.
- 7.2 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Input During Web Page Generation
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdform_<n>_element<id> (Hidden Input field, name = user-defined, e.g. hidden_probe)' parameter in all versions
- 7.5 High severity
10Web Booster – Website speed optimization…: Improper Limitation of a Pathname to a Restricted Directory
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() f
- 9.8 Critical severity
10Web Booster – Website speed optimization…: Unrestricted Upload of File with Dangerous Type
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation
- 7.5 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Special Elements used in an SQL Command
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied para
- 8.8 High severity
Slider by 10Web: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
- 7.2 High severity
10Web Booster – Website speed optimization…: Improper Neutralization of Input During Web Page Generation
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and ou
- 7.6 High severity
Slider by 10Web: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63.
- 7.2 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Input During Web Page Generation
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanit
- 7.1 High severity
Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.
- 7.4 High severity
Slider by 10Web: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63.
- 7.6 High severity
Photo Gallery by 10Web: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.
- 7.5 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Special Elements used in an SQL Command
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and
- 7.2 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Input During Web Page Generation
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization (`sanitize_te
- 7.2 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Unrestricted Upload of File with Dangerous Type
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension
- 7.1 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Input During Web Page Generation
The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions lis
- 8.1 High severity
10Web Booster – Website speed optimization…: Improper Limitation of a Pathname to a Restricted Directory
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and i
- 8.8 High severity
Slider by 10Web – Responsive Image Slider: Improper Neutralization of Special Elements used in an SQL Command
The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient
- 8.8 High severity
Photo Gallery by 10Web – Mobile-Friendly Image…: Improper Limitation of a Pathname to a Restricted Directory
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) th
- 7.5 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Authentication
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature functionality. This makes it possible for unauthenti
- 7.2 High severity
10Web Map Builder for Google Maps: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web 10Web Map Builder for Google Maps.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.74.
- 7.2 High severity
Photo Gallery by 10Web – Mobile-Friendly Image…: Improper Limitation of a Pathname to a Restricted Directory
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitra
- 8.8 High severity
10Web AI Assistant – AI content writing…: Missing Authorization
The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possib
- 7.2 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Special Elements used in an SQL Command
The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- 9.8 Critical severity
Photo Gallery by 10Web – Mobile-Friendly Image…: Improper Neutralization of Special Elements used in an SQL Command
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
- 9.8 Critical severity
Photo Gallery by 10Web – Mobile-Friendly Image…: Improper Neutralization of Special Elements used in an SQL Command
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), lea