3
CVEs
0
Critical
2
High
0
KEV
0
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (20)
Wordpress Plugin
57
Photo Gallery
44
Form Maker
24
PHP
18
Slider
9
Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder
7
Map Builder For Google Maps
3
Form Maker By 10Web
3
10web Booster
2
Photo Gallery By 10web
2
Seo
2
Image Optimizer
2
10Web Social Post Feed
2
Wps Telegram Chat
2
Photo Gallery By 10Web Mobile Friendly Image Gallery
2
10Webanalytics
2
Spidercontacts
1
Sliderby10Web
1
Ai Assistant
1
Slider By 10Web
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-66635 | Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis. | HIGH | 7.4 | 0.2% | 37 |
No patch
|
| CVE-2026-66616 | Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-85645 | Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to inject arbitrary JavaScript into WordPress admin pages via the unsanitized `bulk_action` parameter in the Submissions controller. Successful exploitation requires social-engineering an authenticated WordPress admin into clicking a crafted link, enabling session hijacking or unauthorized admin actions in the victim's browser context. No public exploit code or CISA KEV listing has been identified; version 1.15.47 resolves the issue per confirmed WordPress SVN changesets. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|