7
CVEs
0
Critical
3
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (20)
Wordpress Plugin
57
Photo Gallery
44
Form Maker
24
PHP
18
Slider
9
Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder
7
Map Builder For Google Maps
3
Form Maker By 10Web
3
10web Booster
2
Photo Gallery By 10web
2
Seo
2
Image Optimizer
2
10Web Social Post Feed
2
Wps Telegram Chat
2
Photo Gallery By 10Web Mobile Friendly Image Gallery
2
10Webanalytics
2
Spidercontacts
1
Sliderby10Web
1
Ai Assistant
1
Slider By 10Web
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-28184 | SQL injection in Form Maker by 10Web (WordPress plugin) versions 1.15.44 and earlier allows subscriber-level authenticated users to execute arbitrary SQL queries against the underlying database, achieving high confidentiality impact with scope change beyond the WordPress application boundary. The CVSS score of 8.5 reflects low-privilege exploitation with network access and no required user interaction, making this accessible to any registered WordPress user on an affected site. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.5 | – | 42 |
No patch
|
| CVE-2026-66635 | Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis. | HIGH | 7.4 | 0.2% | 37 |
No patch
|
| CVE-2026-66616 | Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-85645 | Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to inject arbitrary JavaScript into WordPress admin pages via the unsanitized `bulk_action` parameter in the Submissions controller. Successful exploitation requires social-engineering an authenticated WordPress admin into clicking a crafted link, enabling session hijacking or unauthorized admin actions in the victim's browser context. No public exploit code or CISA KEV listing has been identified; version 1.15.47 resolves the issue per confirmed WordPress SVN changesets. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|
| CVE-2026-15993 | Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating. | MEDIUM | 5.3 | 0.3% | 27 |
No patch
|
| CVE-2026-11776 | SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level attackers via the unsanitized 'groupids' parameter. All plugin versions through 1.15.43 are affected across multiple code paths in WDW_FM_Library.php and Generete_csv.php. No active exploitation is confirmed (not in CISA KEV), and exploitation is constrained by the administrator privilege requirement, though the high confidentiality impact from unrestricted database read access remains a meaningful concern for multi-tenant or shared WordPress environments. | MEDIUM | 4.9 | 0.4% | 25 |
No patch
|
| CVE-2026-11777 | SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticated administrators to append arbitrary SQL clauses via the unsanitized 'name' parameter in the admin-side data selection interface, permitting full read access to the underlying WordPress database. The CVSS vector confirms a high confidentiality impact (C:H) but no integrity or availability impact, scoped exclusively to the vulnerable system. No active exploitation is confirmed (not listed in CISA KEV), no public POC has been identified at time of analysis, and the mandatory administrator-level authentication prerequisite substantially constrains real-world mass exploitation risk. | MEDIUM | 4.9 | 0.4% | 25 |
No patch
|