---
title: "10Web Form Maker vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/10web/form-maker
type: product
description: "10Web Form Maker has 26 published CVEs, 0 in CISA KEV and 15 with public exploits."
updated: 2026-05-23
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# 10Web Form Maker vulnerabilities

Vendor: [10Web](https://radicalnotion.ai/vendor/10web)

- **Published CVEs:** 26
- **In CISA KEV:** 0
- **With a public exploit:** 15
- **With a patch:** 25
- **Average CVSS:** 6.1
- **First CVE:** 2019-04-29
- **Latest CVE:** 2026-05-23

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 2 |
| High | 7 |
| Medium | 14 |
| Low | 3 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 17 |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 4 |
| [CWE-1078](https://radicalnotion.ai/cwe/cwe-1078) | Inappropriate Source Code Style or Formatting | 1 |
| [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 |
| [CWE-287](https://radicalnotion.ai/cwe/cwe-287) | Improper Authentication | 1 |
| [CWE-307](https://radicalnotion.ai/cwe/cwe-307) | Improper Restriction of Excessive Authentication Attempts | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2019 | 2 |
| 2020 | 0 |
| 2021 | 1 |
| 2022 | 2 |
| 2023 | 3 |
| 2024 | 10 |
| 2025 | 6 |
| 2026 | 2 |

## Affected versions (top 24 of 38)

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 1.15.19 | range | 2 |
| \< 1.15.25 | range | 2 |
| \< 1.15.30 | range | 2 |
| \< 1.15.31 | range | 2 |
| \< 1.15.33 | range | 2 |
| \< 1.13.3 | range | 1 |
| \< 1.13.5 | range | 1 |
| \< 1.13.60 | range | 1 |
| \< 1.15.20 | range | 1 |
| \< 1.15.21 | range | 1 |
| \< 1.15.23 | range | 1 |
| \< 1.15.24 | range | 1 |
| 1.15.19 | patched | 2 |
| 1.15.25 | patched | 2 |
| 1.15.30 | patched | 2 |
| 1.15.31 | patched | 2 |
| 1.15.33 | patched | 2 |
| 1.13.3 | patched | 1 |
| 1.13.5 | patched | 1 |
| 1.13.60 | patched | 1 |
| 1.15.20 | patched | 1 |
| 1.15.21 | patched | 1 |
| 1.15.23 | patched | 1 |
| 1.15.24 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2018-25346 | WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php | high | 7.1 | No | Yes | No |
| CVE-2025-15441 | Form Maker \< 1.15.38 - SQL Injection | medium | 6.8 | No | Yes | Yes |
| CVE-2024-13053 | Form Maker by 10Web \< 1.15.33 - Admin+ Stored XSS via Theme Title | medium | 4.8 | No | Yes | Yes |
| CVE-2024-10680 | Form Maker by 10Web \< 1.15.32 - Admin+ Stored XSS | medium | 4.8 | No | Yes | Yes |
| CVE-2024-10560 | Form Maker by 10Web \< 1.15.30 - Admin+ Stored XSS | low | 3.5 | No | Yes | Yes |
| CVE-2024-10558 | Form Maker by 10Web \< 1.15.30 - Admin+ Stored XSS | low | 3.5 | No | Yes | Yes |
| CVE-2024-13605 | Form Maker by 10Web \< 1.15.33 - Admin+ Stored XSS | medium | 4.8 | No | Yes | Yes |
| CVE-2024-10562 | Form Maker by 10Web \< 1.15.31 - Admin+ Stored XSS | low | 2.7 | No | Yes | Yes |
| CVE-2024-10265 | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.30 - Reflected Cross-Site Scripting via add\_query\_arg Parameter | medium | 6.1 | No | No | Yes |
| CVE-2024-8633 | Form Maker \<= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting | medium | 5.5 | No | No | Yes |
| CVE-2024-43220 | WordPress Form Maker by 10Web plugin \<= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability | high | 7.1 | No | No | Yes |
| CVE-2024-6130 | Form Maker by 10Web \< 1.15.26 - Admin+ Stored XSS | medium | 4.8 | No | Yes | Yes |
| CVE-2023-48290 | WordPress Form Maker by 10Web plugin \<= 1.15.20 - Captcha Bypass Vulnerability vulnerability | medium | 5.3 | No | No | Yes |
| CVE-2024-34437 | WordPress Form Maker by 10Web plugin \<= 1.15.24 - Cross Site Scripting (XSS) vulnerability | medium | 5.9 | No | No | Yes |
| CVE-2024-2258 | Form Maker by 10Web \<= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting | medium | 5.4 | No | No | Yes |
| CVE-2024-32534 | WordPress Form Maker plugin \<= 1.15.23 - Cross Site Scripting (XSS) vulnerability | medium | 5.9 | No | No | Yes |
| CVE-2024-2112 | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.22 - Sensitive Information Exposure | high | 7.5 | No | No | Yes |
| CVE-2024-0667 | Form-Maker (twb\_form-maker) \<= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute | medium | 6.3 | No | No | Yes |
| CVE-2023-45071 | WordPress Form Maker by 10Web Plugin \<= 1.15.18 is vulnerable to Cross Site Scripting (XSS) | high | 7.1 | No | No | Yes |
| CVE-2023-45070 | WordPress Form Maker by 10Web Plugin \<= 1.15.18 is vulnerable to Cross Site Scripting (XSS) | high | 7.1 | No | No | Yes |
| CVE-2023-4666 | Form-Maker \< 1.15.20 - Unauthenticated Arbitrary File Upload | critical | 9.8 | No | Yes | Yes |
| CVE-2022-3300 | Form Maker by 10Web \< 1.15.6 - Admin+ SQLI | high | 7.2 | No | Yes | Yes |
| CVE-2022-1564 | Form Maker By 10Web \< 1.14.12 - Admin+ Stored Cross-Site Scripting | medium | 4.8 | No | Yes | Yes |
| CVE-2021-24526 | Form Maker \< 1.13.60 - Authenticated Stored XSS | medium | 5.4 | No | Yes | Yes |
| CVE-2019-10866 | - | critical | 9.8 | No | Yes | Yes |
| CVE-2019-11590 | - | high | 8.8 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does 10Web Form Maker have?

10Web Form Maker has 26 published CVE records since 2019.

### How many 10Web Form Maker CVEs are in CISA KEV?

None of 10Web Form Maker's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for 10Web Form Maker vulnerabilities?

Yes — 15 of 10Web Form Maker's CVEs have a known public exploit.

### Which versions of 10Web Form Maker are affected?

38 distinct 10Web Form Maker versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in 10Web Form Maker CVEs?

10Web Form Maker's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-1078 (Inappropriate Source Code Style or Formatting), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

### How many critical 10Web Form Maker vulnerabilities are there?

10Web Form Maker has 2 critical and 7 high-severity CVEs.

### What is the average severity of 10Web Form Maker CVEs?

The average CVSS base score across 10Web Form Maker's scored CVEs is 6.1.

## Other products from this vendor

- [photo gallery](https://radicalnotion.ai/vendor/10web/photo-gallery) (49 CVEs)
- [Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder](https://radicalnotion.ai/vendor/10web/form-maker-by-10web-mobile-friendly-drag-and-drop-contact-form-builder) (20 CVEs)
- [Photo Gallery by 10Web – Mobile-Friendly Image Gallery](https://radicalnotion.ai/vendor/10web/photo-gallery-by-10web-mobile-friendly-image-gallery) (15 CVEs)
- [slider](https://radicalnotion.ai/vendor/10web/slider) (12 CVEs)
- [Photo Gallery by 10Web](https://radicalnotion.ai/vendor/10web/photo-gallery-by-10web) (6 CVEs)
- [10Web Booster – Website speed optimization, Cache & Page Speed optimizer](https://radicalnotion.ai/vendor/10web/10web-booster-website-speed-optimization-cache-and-page-speed-optimizer) (5 CVEs)
- [PhotoGallery](https://radicalnotion.ai/vendor/10web/photogallery) (5 CVEs)
- [Slider by 10Web](https://radicalnotion.ai/vendor/10web/slider-by-10web) (5 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/10web/form-maker). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.