Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder vulnerabilities
8 known vulnerabilities in Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder from 10Web. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Input During Web Page Generation
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdform_<n>_element<id> (Hidden Input field, name = user-defined, e.g. hidden_probe)' parameter in all versions
- 7.5 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Special Elements used in an SQL Command
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied para
- 7.2 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Input During Web Page Generation
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanit
- 7.5 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Special Elements used in an SQL Command
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and
- 7.2 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Input During Web Page Generation
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization (`sanitize_te
- 7.2 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Unrestricted Upload of File with Dangerous Type
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension
- 7.1 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Neutralization of Input During Web Page Generation
The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions lis
- 7.5 High severity
Form Maker by 10Web – Mobile-Friendly Drag &…: Improper Authentication
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature functionality. This makes it possible for unauthenti