Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder
Monthly
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthenticated remote attackers append additional SQL to queries built from the 'inputs' parameter, allowing them to extract sensitive information from the site's database. The plugin's nonce check offers no real protection because the required nonce is emitted into the HTML source of every public page that renders a form, so the only practical prerequisite is that a Form Maker form be reachable by an anonymous visitor - the normal way a contact-form plugin is deployed. CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code has been identified at time of analysis, and the issue should still be treated as high priority given how trivially the vulnerable handler can be reached.
Stored cross-site scripting in the 10Web Form Maker WordPress plugin through version 1.15.47 lets unauthenticated attackers plant arbitrary JavaScript in a site by submitting crafted Longitude/Latitude values into a 'Mark on Map' form field. The injected script is stored and later rendered without adequate escaping, most practically firing when an administrator opens the submission or map-edit views referenced in the source (Submissions_fm.php, FMMapEditinPopup.php). Wordfence rates it CVSS 3.1 7.2 (High) with a PR:N vector, so no account is needed to inject on a site that publishes a form containing the map field; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated SQL injection in Form Maker by 10Web plugin allows remote attackers to extract sensitive database contents including user credentials, form submissions, and WordPress configuration data. The vulnerability affects all versions through 1.15.42 and requires no special configuration - any WordPress site running the plugin with default settings is exploitable. CVSS 7.5 (High) reflects network-based unauthenticated access with high confidentiality impact. EPSS data not provided; no CISA KEV listing identified, indicating no confirmed widespread exploitation at time of analysis. Patch available in version 1.15.43 per Trac changeset 3518461.
Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers to inject malicious JavaScript through Matrix field submissions that executes when administrators view submission details. The vulnerability stems from inadequate sanitization (sanitize_text_field removes tags but preserves quotes) and missing output escaping in the admin Submissions view. With CVSS 7.2 (High) and network-based attack vector requiring no privileges or user int
Reflected cross-site scripting (XSS) in the Form Maker by 10Web WordPress plugin (versions up to and including 1.15.48) allows unauthenticated attackers to inject arbitrary web scripts via the 'inputs' array key parameter. Exploitation requires tricking a user into clicking a crafted link while a vulnerable form page is reachable; the impact escalates if an authenticated administrator is the victim. No public exploit identified at time of analysis, and the vendor released a patch in version 1.15.49.
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to inject arbitrary JavaScript into WordPress admin pages via the unsanitized `bulk_action` parameter in the Submissions controller. Successful exploitation requires social-engineering an authenticated WordPress admin into clicking a crafted link, enabling session hijacking or unauthorized admin actions in the victim's browser context. No public exploit code or CISA KEV listing has been identified; version 1.15.47 resolves the issue per confirmed WordPress SVN changesets.
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating.
SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level attackers via the unsanitized 'groupids' parameter. All plugin versions through 1.15.43 are affected across multiple code paths in WDW_FM_Library.php and Generete_csv.php. No active exploitation is confirmed (not in CISA KEV), and exploitation is constrained by the administrator privilege requirement, though the high confidentiality impact from unrestricted database read access remains a meaningful concern for multi-tenant or shared WordPress environments.
SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticated administrators to append arbitrary SQL clauses via the unsanitized 'name' parameter in the admin-side data selection interface, permitting full read access to the underlying WordPress database. The CVSS vector confirms a high confidentiality impact (C:H) but no integrity or availability impact, scoped exclusively to the vulnerable system. No active exploitation is confirmed (not listed in CISA KEV), no public POC has been identified at time of analysis, and the mandatory administrator-level authentication prerequisite substantially constrains real-world mass exploitation risk.
SQL injection in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows authenticated administrators to extract sensitive database information via unsanitized parameters (ip_search, startdate, enddate, username_search, useremail_search) in the Submissions display function. The vulnerability stems from the validate_data() method stripping WordPress's magic quotes protection and get_labels_parameters() concatenating user input directly into SQL queries without prepared statements. A CSRF vector exists because the vulnerable display task lacks nonce verification, enabling attackers to trick administrators into triggering the injection via a crafted link. Exploitation requires Administrator-level privileges but can be chained with CSRF for unauthorized triggering.
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthenticated remote attackers append additional SQL to queries built from the 'inputs' parameter, allowing them to extract sensitive information from the site's database. The plugin's nonce check offers no real protection because the required nonce is emitted into the HTML source of every public page that renders a form, so the only practical prerequisite is that a Form Maker form be reachable by an anonymous visitor - the normal way a contact-form plugin is deployed. CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code has been identified at time of analysis, and the issue should still be treated as high priority given how trivially the vulnerable handler can be reached.
Stored cross-site scripting in the 10Web Form Maker WordPress plugin through version 1.15.47 lets unauthenticated attackers plant arbitrary JavaScript in a site by submitting crafted Longitude/Latitude values into a 'Mark on Map' form field. The injected script is stored and later rendered without adequate escaping, most practically firing when an administrator opens the submission or map-edit views referenced in the source (Submissions_fm.php, FMMapEditinPopup.php). Wordfence rates it CVSS 3.1 7.2 (High) with a PR:N vector, so no account is needed to inject on a site that publishes a form containing the map field; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated SQL injection in Form Maker by 10Web plugin allows remote attackers to extract sensitive database contents including user credentials, form submissions, and WordPress configuration data. The vulnerability affects all versions through 1.15.42 and requires no special configuration - any WordPress site running the plugin with default settings is exploitable. CVSS 7.5 (High) reflects network-based unauthenticated access with high confidentiality impact. EPSS data not provided; no CISA KEV listing identified, indicating no confirmed widespread exploitation at time of analysis. Patch available in version 1.15.43 per Trac changeset 3518461.
Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers to inject malicious JavaScript through Matrix field submissions that executes when administrators view submission details. The vulnerability stems from inadequate sanitization (sanitize_text_field removes tags but preserves quotes) and missing output escaping in the admin Submissions view. With CVSS 7.2 (High) and network-based attack vector requiring no privileges or user int
Reflected cross-site scripting (XSS) in the Form Maker by 10Web WordPress plugin (versions up to and including 1.15.48) allows unauthenticated attackers to inject arbitrary web scripts via the 'inputs' array key parameter. Exploitation requires tricking a user into clicking a crafted link while a vulnerable form page is reachable; the impact escalates if an authenticated administrator is the victim. No public exploit identified at time of analysis, and the vendor released a patch in version 1.15.49.
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to inject arbitrary JavaScript into WordPress admin pages via the unsanitized `bulk_action` parameter in the Submissions controller. Successful exploitation requires social-engineering an authenticated WordPress admin into clicking a crafted link, enabling session hijacking or unauthorized admin actions in the victim's browser context. No public exploit code or CISA KEV listing has been identified; version 1.15.47 resolves the issue per confirmed WordPress SVN changesets.
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating.
SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level attackers via the unsanitized 'groupids' parameter. All plugin versions through 1.15.43 are affected across multiple code paths in WDW_FM_Library.php and Generete_csv.php. No active exploitation is confirmed (not in CISA KEV), and exploitation is constrained by the administrator privilege requirement, though the high confidentiality impact from unrestricted database read access remains a meaningful concern for multi-tenant or shared WordPress environments.
SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticated administrators to append arbitrary SQL clauses via the unsanitized 'name' parameter in the admin-side data selection interface, permitting full read access to the underlying WordPress database. The CVSS vector confirms a high confidentiality impact (C:H) but no integrity or availability impact, scoped exclusively to the vulnerable system. No active exploitation is confirmed (not listed in CISA KEV), no public POC has been identified at time of analysis, and the mandatory administrator-level authentication prerequisite substantially constrains real-world mass exploitation risk.
SQL injection in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows authenticated administrators to extract sensitive database information via unsanitized parameters (ip_search, startdate, enddate, username_search, useremail_search) in the Submissions display function. The vulnerability stems from the validate_data() method stripping WordPress's magic quotes protection and get_labels_parameters() concatenating user input directly into SQL queries without prepared statements. A CSRF vector exists because the vulnerable display task lacks nonce verification, enabling attackers to trick administrators into triggering the injection via a crafted link. Exploitation requires Administrator-level privileges but can be chained with CSRF for unauthorized triggering.