Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 39 vulnerability records associated with Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder, published between 2018 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

39Total records
1Critical
12High
26Medium
0Low
0Informational
39Patched records
0Currently marked unpatched
2018-04-27First disclosure
2026-06-17Latest disclosure
36 of 39CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201811 records
201922 records
202022 records
202111 records
202222 records
202355 records
20241111 records
202566 records
202699 records

Severity Breakdown

SeverityRecordsShare
Critical12.6%
High1230.8%
Medium2666.7%

Vulnerability-Type Breakdown

Cross-Site Scripting

22 records56.4%

First: 2020. Latest: 2026.

SQL Injection

9 records23.1%

First: 2019. Latest: 2026.

Other

2 records5.1%

First: 2018. Latest: 2023.

CSRF

2 records5.1%

First: 2019. Latest: 2024.

Arbitrary File Upload

2 records5.1%

First: 2023. Latest: 2026.

Missing Authorization

1 record2.6%

First: 2023. Latest: 2023.

Authentication Bypass

1 record2.6%

First: 2024. Latest: 2024.

Patch Status

Patched
39
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 1.15.44
  • 1.15.43
  • 1.15.41
  • 1.15.39
  • 1.15.38
  • 1.15.36
  • 1.15.34
  • 1.15.32
  • 1.15.30
  • 1.15.33
  • 1.15.31
  • 1.15.28
  • 1.15.27
  • 1.15.26
  • 1.15.25
  • 1.15.24
  • 1.15.23
  • 1.15.22
  • 1.15.21
  • 1.15.19
  • 1.15.20
  • 1.15.17
  • 1.15.6
  • 1.14.12
  • 1.13.60
  • 1.13.40
  • 1.13.36
  • 1.13.3
  • 1.13.5
  • 1.12.22

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-1.15.43Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' ParameterJune 17, 20261.15.44Medium
*-1.15.43Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' ParameterJune 17, 20261.15.44Medium
*-1.15.42Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'May 4, 20261.15.43High
*-1.15.40Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' ParameterApril 16, 20261.15.41Medium
*-1.15.40Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text BoxApril 13, 20261.15.41High
*-1.15.38Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL InjectionApril 8, 20261.15.39High
[*, 1.15.38)Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL InjectionMarch 23, 20261.15.38High
*-1.15.35Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden FieldFebruary 2, 20261.15.36High
*-1.15.35Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG fileFebruary 2, 20261.15.36High
*-1.15.33Form Maker by 10Web <= 1.15.33 - Authenticated (Administrator+) Stored Cross-Site ScriptingMay 19, 20251.15.34Medium
*-1.15.31Form Maker by 10Web <= 1.15.31 - Authenticated (Administrator+) Stored Cross-Site ScriptingMarch 26, 20251.15.32Medium
*-1.15.29Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site ScriptingMarch 3, 20251.15.30Medium
*-1.15.29Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site ScriptingMarch 2, 20251.15.30Medium
*-1.15.32Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site ScriptingFebruary 7, 20251.15.33Medium
*-1.15.32Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site ScriptingFebruary 3, 20251.15.33Medium
*-1.15.30Form Maker by 10Web <= 1.15.30 - Authenticated (Admin+) Stored Cross-Site ScriptingDecember 17, 20241.15.31Medium
*-1.15.27Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryDecember 3, 20241.15.28Medium
*-1.15.30Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg ParameterNovember 10, 20241.15.31Medium
*-1.15.27Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site ScriptingSeptember 25, 20241.15.28Medium
*-1.15.26Form Maker by 10Web <= 1.15.26 - Reflected Cross-Site ScriptingAugust 9, 20241.15.27Medium
*-1.15.25Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.25 - Authenticated (Admin+) Stored Cross-Site ScriptingJune 10, 20241.15.26Medium
*-1.15.24Form Maker by 10Web <= 1.15.24 - Authenticated (Administrator+) Stored Cross-Site ScriptingMay 7, 20241.15.25Medium
*-1.15.24Form Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site ScriptingApril 26, 20241.15.25Medium
*-1.15.23Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.23 - Authenticated (Admin+) Stored Cross-Site ScriptingApril 15, 20241.15.24Medium
*-1.15.22Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information ExposureMarch 22, 20241.15.23Medium

Selected source records

Latest Records

MediumCVE-2026-11776

Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter

Published: June 17, 2026

Affected versions
*-1.15.43
Patched versions
1.15.44
Original Wordfence record
MediumCVE-2026-11777

Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter

Published: June 17, 2026

Affected versions
*-1.15.43
Patched versions
1.15.44
Original Wordfence record
HighCVE-2026-3359

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'

Published: May 4, 2026

Affected versions
*-1.15.42
Patched versions
1.15.43
Original Wordfence record
MediumCVE-2026-3330

Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter

Published: April 16, 2026

Affected versions
*-1.15.40
Patched versions
1.15.41
Original Wordfence record
HighCVE-2026-4388

Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box

Published: April 13, 2026

Affected versions
*-1.15.40
Patched versions
1.15.41
Original Wordfence record
HighCVE-2026-39502

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection

Published: April 8, 2026

Affected versions
*-1.15.38
Patched versions
1.15.39
Original Wordfence record
HighCVE-2025-15441

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL Injection

Published: March 23, 2026

Affected versions
[*, 1.15.38)
Patched versions
1.15.38
Original Wordfence record
HighCVE-2026-1058

Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field

Published: February 2, 2026

Affected versions
*-1.15.35
Patched versions
1.15.36
Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-4666

Form Maker by 10Web <= 1.15.19 - Unauthenticated Arbitrary File Upload

Published: September 7, 2023

Affected versions
[*, 1.15.20)
Patched versions
1.15.20
Original Wordfence record
HighCVE-2019-10866

Form Maker by 10Web <= 1.13.2 - Authenticated SQL Injection

Published: May 10, 2019

Affected versions
[*, 1.13.3)
Patched versions
1.13.3
Original Wordfence record
HighCVE-2019-11590

Form Maker by 10Web <= 1.13.4 - Cross-Site Request Forgery to Local File Inclusion

Published: April 5, 2019

Affected versions
*-1.13.4
Patched versions
1.13.5
Original Wordfence record
HighCVE-2018-10504

Form Maker by 10Web <= 1.12.21 - CSV Injection

Published: April 27, 2018

Affected versions
[*, 1.12.22)
Patched versions
1.12.22
Original Wordfence record
HighCVE-2026-39502

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection

Published: April 8, 2026

Affected versions
*-1.15.38
Patched versions
1.15.39
Original Wordfence record
HighCVE-2025-15441

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL Injection

Published: March 23, 2026

Affected versions
[*, 1.15.38)
Patched versions
1.15.38
Original Wordfence record
HighCVE-2026-3359

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'

Published: May 4, 2026

Affected versions
*-1.15.42
Patched versions
1.15.43
Original Wordfence record
HighCVE-2022-3300

Form Maker <= 1.15.5 - Authenticated (Administrator+) SQL Injection

Published: September 29, 2022

Affected versions
*-1.15.5
Patched versions
1.15.6
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory