10Web vulnerabilities
145 vulnerabilities
Known vulnerabilities in 10Web products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 29 products.
Products
29- Photo Gallery49 vulnerabilities
- Form Maker25 vulnerabilities
- Form Maker By 10Web – Mobile Friendly Drag & Drop Contact Form Builder18 vulnerabilities
- Photo Gallery By 10Web – Mobile Friendly Image Gallery15 vulnerabilities
- Slider9 vulnerabilities
- Photo Gallery By 10Web6 vulnerabilities
- 10Web Booster – Website Speed Optimization, Cache & Page Speed Optimizer5 vulnerabilities
- Photogallery5 vulnerabilities
- Slider By 10Web5 vulnerabilities
- Map Builder For Google Maps4 vulnerabilities
- 10Web Map Builder For Google Maps3 vulnerabilities
- Form Maker By 10Web3 vulnerabilities
- 10Web Booster2 vulnerabilities
- 10Web Social Post Feed2 vulnerabilities
- 10Webanalytics2 vulnerabilities
- Image Optimizer2 vulnerabilities
- Seo2 vulnerabilities
- Wps Telegram Chat2 vulnerabilities
- 10Web AI Assistant – AI Content Writing Assistant1 vulnerabilities
- 10Web Social Photo Feed1 vulnerabilities
- 10Websocial1 vulnerabilities
- Ai Assistant1 vulnerabilities
- SEO By 10Web1 vulnerabilities
- Slider By 10Web – Responsive Image Slider1 vulnerabilities
- Sliderby10Web1 vulnerabilities
- Spidercalendar1 vulnerabilities
- Spidercontacts1 vulnerabilities
- WD Widgettwitter1 vulnerabilities
- Wdcontactformbuilder1 vulnerabilities
CVE-2026-10389610web10web booster – website speed optimization, cache & page speed optimizer
EPSS score0.46%
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.CVE-2026-1855710webphoto gallery by 10web – mobile-friendly image galleryEPSS score0.21%
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.CVE-2026-10858710web10web booster – website speed optimization, cache & page speed optimizerEPSS score0.92%
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.CVE-2026-9580810webform maker by 10web – mobile-friendly drag & drop contact form builder+1EPSS score0.43%
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.CVE-2018-2534610webform_makerEPSS score0.20%
WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.CVE-2021-3169310webphoto_gallery+1EPSS score0.43%
The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware information, previously connected to this CVE ID because of a typo, is at CVE-2022-31693.CVE-2021-2504110webphoto_gallery+2EPSS score0.91%
The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX actionCVE-2021-2504710web10websocial+2EPSS score0.80%
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in usersCVE-2021-4688910webphoto_gallery+1EPSS score0.57%
The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.CVE-2021-2431010webphoto_gallery+2EPSS score1.13%
The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117CVE-2021-2452610webform_maker+2EPSS score1.09%
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issueCVE-2021-2436310webphoto_gallery+2EPSS score1.89%
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vectorCVE-2021-2413210webslider+2EPSS score2.59%
The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks.CVE-2021-2436210webphoto_gallery+2EPSS score0.83%
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly (ie in the /wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issueCVE-2021-2413910webphoto_gallery+2EPSS score5.55%
Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.CVE-2021-2429110webphoto_gallery+2EPSS score14.51%
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)CVE-2015-232410webphoto_gallery+1EPSS score0.86%
Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors.CVE-2015-139410webphoto_gallery+1EPSS score2.33%
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.CVE-2015-105510webphoto_gallery+1EPSS score2.13%
SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.CVE-2015-139310webphoto_gallery+1EPSS score1.65%
SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.