WordPress form-maker has 19 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-10866 | In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the fi | critical | 9.8 | <1.13.3 | 1.13.3 |
| CVE-2018-10504 | The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. | high | 7.8 | <1.12.24 | 1.12.24 |
| CVE-2023-4666 | The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allow | critical | 9.8 | <1.15.20 | 1.15.20 |
| CVE-2022-3300 | The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, | high | 7.2 | <1.15.6 | 1.15.6 |
| CVE-2019-11590 | The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local f | high | 8.8 | <1.13.5 | 1.13.5 |
| CVE-2021-24526 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title be | medium | 5.4 | <1.13.60 | 1.13.60 |
| CVE-2022-1564 | The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privil | medium | 4.8 | <=1.14.12 | – |
| CVE-2024-2112 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Expos | medium | 5.9 | <1.15.23 | 1.15.23 |
| CVE-2024-6130 | The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | <1.15.26 | 1.15.26 |
| CVE-2024-10562 | The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege | low | 2.7 | <1.15.31 | 1.15.31 |
| CVE-2024-10265 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Script | medium | 6.1 | <1.15.31 | 1.15.31 |
| CVE-2024-13605 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | <1.15.33 | 1.15.33 |
| CVE-2024-2258 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 4.4 | <1.15.25 | 1.15.25 |
| CVE-2024-8633 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 5.5 | <1.15.28 | 1.15.28 |
| CVE-2024-13053 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | <1.15.33 | 1.15.33 |
| CVE-2024-10560 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | <1.15.30 | 1.15.30 |
| CVE-2024-10680 | The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | <1.15.32 | 1.15.32 |
| CVE-2024-10558 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | <1.15.30 | 1.15.30 |
| CVE-2024-0667 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 5.4 | <=1.15.21 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked