Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder vulnerabilities

Product

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

by 10web · last CVE Oct 14, 2026

CVEs

On KEV

7.5

Max CVSS

New 30D

Vulnerabilities12 In the news0 Timeline

Severity mix

Critical 0High 6Medium 6Low 0

Severity

All severities12 Critical0 High6 Medium6 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-95808	7.5	0%	Oct 14	Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter Affected: through 1.15.48
CVE-2026-3359	7.5	0%	May 5	Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs' Affected: through 1.15.42
CVE-2026-96813	7.2	0%	Oct 1	Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields Affected: through 1.15.47
CVE-2026-4388	7.2	0%	Apr 14	Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box Affected: through 1.15.40
CVE-2026-1065	7.2	0%	Feb 3	Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file Affected: through 1.15.35
CVE-2026-1058	7.1	0%	Feb 3	Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field Affected: through 1.15.35
CVE-2026-103998	6.1	0%	Oct 10	Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key Affected: through 1.15.48
CVE-2026-85645	6.1	0%	Sep 10	Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting Affected: through 1.15.46
CVE-2026-15993	5.3	0%	Aug 15	Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause Affected: through 1.15.44
CVE-2026-11776	4.9	0%	Jun 18	Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter Affected: through 1.15.43
CVE-2026-11777	4.9	0%	Jun 18	Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter Affected: through 1.15.43
CVE-2026-3330	4.9	0%	Apr 17	Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter Affected: through 1.15.40