# cve.now: 10web

The newest entries naming 10web as an affected vendor (up to 200), of 74 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119483](https://cve.now/CVE-2026-119483.md): WordPress Form Maker by 10Web plugin \<= 1.15.50 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-118067](https://cve.now/CVE-2026-118067.md): Form Maker by 10Web \<= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled\_fields Parameter (CVSS 5.4)
- [CVE-2026-120512](https://cve.now/CVE-2026-120512.md): Form Maker by 10Web \<= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value (CVSS 7.2)
- [CVE-2026-118081](https://cve.now/CVE-2026-118081.md): WordPress 10Web Social Photo Feed plugin \<= 1.5.6 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-103896](https://cve.now/CVE-2026-103896.md): 10Web Booster \<= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path (CVSS 7.5)
- [CVE-2026-18557](https://cve.now/CVE-2026-18557.md): Photo Gallery by 10Web \<= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter (CVSS 6.1)
- [CVE-2026-108587](https://cve.now/CVE-2026-108587.md): 10Web Booster \<= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page\_id' Parameter (CVSS 9.8)
- [CVE-2026-95808](https://cve.now/CVE-2026-95808.md): Form Maker by 10Web \<= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter (CVSS 7.5)
- [CVE-2026-42715](https://cve.now/CVE-2026-42715.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.47 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-42711](https://cve.now/CVE-2026-42711.md): WordPress Slider by 10Web plugin \<= 1.2.63 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-105885](https://cve.now/CVE-2026-105885.md): WordPress Slider by 10Web plugin \<= 1.2.62 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-107742](https://cve.now/CVE-2026-107742.md): 10Web Booster \<= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (CVSS 7.2)
- [CVE-2026-103998](https://cve.now/CVE-2026-103998.md): Form Maker by 10Web \<= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key (CVSS 6.1)
- [CVE-2026-42710](https://cve.now/CVE-2026-42710.md): WordPress Slider by 10Web plugin \<= 1.2.63 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-39787](https://cve.now/CVE-2026-39787.md): WordPress 10Web Social Photo Feed plugin \<= 1.4.35 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-92974](https://cve.now/CVE-2026-92974.md): Photo Gallery by 10Web \<= 1.8.46 - Reflected Cross-Site Scripting via 'thumb\_url' Parameter (CVSS 6.1)
- [CVE-2026-96813](https://cve.now/CVE-2026-96813.md): Form Maker by 10Web \<= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields (CVSS 7.2)
- [CVE-2026-102377](https://cve.now/CVE-2026-102377.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.46 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-94121](https://cve.now/CVE-2026-94121.md): WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin \<= 2.33.6 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-85652](https://cve.now/CVE-2026-85652.md): Photo Gallery by 10Web \<= 1.8.44 - Authenticated (Author+) SQL Injection via 'album\_id' Shortcode Attribute (CVSS 6.5)
- [CVE-2026-86311](https://cve.now/CVE-2026-86311.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2026-85645](https://cve.now/CVE-2026-85645.md): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.46 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2026-66616](https://cve.now/CVE-2026-66616.md): WordPress Form Maker by 10Web plugin \<= 1.15.49 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66635](https://cve.now/CVE-2026-66635.md): WordPress Slider by 10Web plugin \<= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.4)
- [CVE-2026-15993](https://cve.now/CVE-2026-15993.md): Form Maker by 10Web \<= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause (CVSS 5.3)
- [CVE-2026-11776](https://cve.now/CVE-2026-11776.md): Form Maker by 10Web \<= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter (CVSS 4.9)
- [CVE-2026-11777](https://cve.now/CVE-2026-11777.md): Form Maker by 10Web \<= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter (CVSS 4.9)
- [CVE-2026-39502](https://cve.now/CVE-2026-39502.md): WordPress Form Maker by 10Web plugin \<= 1.15.38 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-9829](https://cve.now/CVE-2026-9829.md): Photo Gallery by 10Web \<= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact\_album\_order\_by' Shortcode Parameter (CVSS 6.5)
- [CVE-2026-49771](https://cve.now/CVE-2026-49771.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.41 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-7048](https://cve.now/CVE-2026-7048.md): Photo Gallery by 10Web \<= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order\_by' Shortcode Attribute (CVSS 6.5)
- [CVE-2018-25346](https://cve.now/CVE-2018-25346.md): WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php (CVSS 7.1)
- [CVE-2026-3359](https://cve.now/CVE-2026-3359.md): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.42 - Unauthenticated SQL Injection via 'inputs' (CVSS 7.5)
- [CVE-2026-3330](https://cve.now/CVE-2026-3330.md): Form Maker by 10Web \<= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip\_search' Parameter (CVSS 4.9)
- [CVE-2026-4388](https://cve.now/CVE-2026-4388.md): Form Maker by 10Web \<= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box (CVSS 7.2)
- [CVE-2026-32330](https://cve.now/CVE-2026-32330.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2026-27360](https://cve.now/CVE-2026-27360.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.38 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2026-1058](https://cve.now/CVE-2026-1058.md): Form Maker by 10Web \<= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field (CVSS 7.1)
- [CVE-2026-1065](https://cve.now/CVE-2026-1065.md): Form Maker by 10Web \<= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file (CVSS 7.2)
- [CVE-2026-1036](https://cve.now/CVE-2026-1036.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion (CVSS 5.3)
- [CVE-2025-13377](https://cve.now/CVE-2025-13377.md): 10Web Booster \<= 2.32.7 - Authenticated (Subscriber+) Arbitrary Folder Deletion via two\_clear\_page\_cache (CVSS 9.6)
- [CVE-2020-36853](https://cve.now/CVE-2020-36853.md): 10WebMapBuilder \<= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change (CVSS 7.2)
- [CVE-2025-48341](https://cve.now/CVE-2025-48341.md): WordPress Form Maker by 10Web plugin \<= 1.15.33 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-2269](https://cve.now/CVE-2025-2269.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.34 Reflected Cross-Site Scripting via 'image\_id' Parameter (CVSS 6.1)
- [CVE-2023-45272](https://cve.now/CVE-2023-45272.md): WordPress 10Web Map Builder for Google Maps plugin \<= 1.0.73 - Notice Dismissal Vulnerability (CVSS 5.4)
- [CVE-2023-47807](https://cve.now/CVE-2023-47807.md): WordPress 10WebAnalytics plugin \<= 1.2.12 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-5020](https://cve.now/CVE-2024-5020.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
- [CVE-2024-10265](https://cve.now/CVE-2024-10265.md): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.30 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1)
- [CVE-2024-9878](https://cve.now/CVE-2024-9878.md): Photo Gallery by 10Web \<= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-9607](https://cve.now/CVE-2024-9607.md): 10Web Social Post Feed \<= 1.2.9 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-44043](https://cve.now/CVE-2024-44043.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.27 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-8633](https://cve.now/CVE-2024-8633.md): Form Maker \<= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5)
- [CVE-2024-7150](https://cve.now/CVE-2024-7150.md): Slider by 10Web – Responsive Image Slider \<= 1.2.57 - Authenticated (Contributor+) SQL Injection via id Parameter (CVSS 8.8)
- [CVE-2024-5481](https://cve.now/CVE-2024-5481.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc\_dir Function (CVSS 6.8)
- [CVE-2024-5426](https://cve.now/CVE-2024-5426.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG (CVSS 6.4)
- [CVE-2024-2258](https://cve.now/CVE-2024-2258.md): Form Maker by 10Web \<= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-32578](https://cve.now/CVE-2024-32578.md): WordPress Sliderby10Web plugin \<= 1.2.54 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-2112](https://cve.now/CVE-2024-2112.md): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.22 - Sensitive Information Exposure (CVSS 5.9)
- [CVE-2024-2296](https://cve.now/CVE-2024-2296.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG (CVSS 5.5)
- [CVE-2024-31116](https://cve.now/CVE-2024-31116.md): WordPress 10Web Map Builder for Google Maps plugin \<= 1.0.74 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-29833](https://cve.now/CVE-2024-29833.md): WordPress Photo Gallery Plugin \<= 1.8.21 Stored Cross Site Scripting in UploadHandler (CVSS 5.4)
- [CVE-2024-29810](https://cve.now/CVE-2024-29810.md): WordPress Photo Gallery Plugin \<= 1.8.21 Reflected Cross Site Scripting in editimage\_bwg thumb\_url (CVSS 5.4)
- [CVE-2024-29809](https://cve.now/CVE-2024-29809.md): WordPress Photo Gallery Plugin \<= 1.8.21 Reflected Cross Site Scripting in editimage\_bwg image\_url (CVSS 5.4)
- [CVE-2024-29808](https://cve.now/CVE-2024-29808.md): WordPress Photo Gallery Plugin \<= 1.8.21 Reflected Cross Site Scripting in editimage\_bwg image\_id (CVSS 5.4)
- [CVE-2024-29832](https://cve.now/CVE-2024-29832.md): WordPress Photo Gallery Plugin \<= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current\_url (CVSS 6.1)
- [CVE-2024-0221](https://cve.now/CVE-2024-0221.md): Photo Gallery by 10Web - Mobile-Friendly Image Gallery \<= 1.8.19 - Directory Traversal to Arbitrary File Rename (CVSS 9.1)
- [CVE-2023-6985](https://cve.now/CVE-2023-6985.md): 10Web AI Assistant – AI content writing assistant \<= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation (CVSS 6.5)
- [CVE-2024-0667](https://cve.now/CVE-2024-0667.md): Form-Maker (twb\_form-maker) \<= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute (CVSS 5.4)
- [CVE-2023-6924](https://cve.now/CVE-2023-6924.md): Photo Gallery by 10Web \<= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget (CVSS 4.4)
- [CVE-2023-5048](https://cve.now/CVE-2023-5048.md): WDContactFormBuilder \<= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2023-34375](https://cve.now/CVE-2023-34375.md): WordPress Seo By 10Web Plugin \<= 1.2.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-5709](https://cve.now/CVE-2023-5709.md): WD WidgetTwitter \<= 1.0.9 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8)
- [CVE-2020-36756](https://cve.now/CVE-2020-36756.md): 10WebAnalytics \<= 1.2.8 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2021-24310](https://cve.now/CVE-2021-24310.md): Photo Gallery \< 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/10web
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.