CVE-2026-66616

The Form Maker by 10Web plugin for WordPress up to version 1.15.48 is vulnerable to blind SQL Injection via the 'inputs' parameter due to insufficient escaping and preparation, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The Form Maker by 10Web, a plugin for creating contact forms in WordPress, is vulnerable to SQL Injection via the 'inputs' parameter in versions up to and including 1.15.42. This is due to insufficient escaping of user-supplied parameters and lack of proper preparation of the existing SQL query.

There is an unauthenticated SQL injection vulnerability in Form Maker by 10Web versions up to 1.15.38.

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to and including 1.15.48 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Form Maker by 10Web plugin for WordPress up to version 1.15.44 is vulnerable to blind SQL injection via the '{username}' placeholder in a dynamic-choice field. Authenticated attackers with subscriber-level access can append additional SQL queries to extract sensitive information from the database.

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.

The Form Maker by 10Web, a plugin for creating contact forms in WordPress, is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to and including 1.15.43. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.

The Form Maker by 10Web, a plugin for creating contact forms in WordPress, is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to and including 1.15.43. This issue arises from insufficient escaping of the user-supplied parameter and lack of proper preparation of the existing SQL query.