
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Security & Risk Analysis
wordpress.org/plugins/form-makerForm Maker is a user-friendly contact form builder that allows to create forms for any purpose, from a simple contact form to multi page survey forms
Is Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Safe to Use in 2026?
Mostly Safe
Score 82/100Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder is generally safe to use. 36 past CVEs were resolved.
The Form Maker plugin version 1.15.37 exhibits a concerning security posture, despite some positive indicators. The static analysis reveals a substantial attack surface of 29 entry points, with a significant portion (7) lacking proper authentication checks. This directly translates to an increased risk of unauthorized access and potential exploitation. Furthermore, the presence of the 'unserialize' dangerous function and a high rate of unsanitized taint flows (15 out of 18 analyzed) are critical red flags, indicating potential vulnerabilities related to deserialization attacks and injection flaws.
The plugin's vulnerability history is particularly alarming, with 31 known CVEs, including a past critical vulnerability and a significant number of high and medium severity issues. The common vulnerability types listed, such as Cross-Site Scripting (XSS), SQL Injection, and Unrestricted File Upload, are directly related to the identified weaknesses in the code analysis, such as poor output escaping and potential injection points. While there are currently no unpatched CVEs, the historical pattern suggests a recurring struggle with secure coding practices.
While the plugin does utilize prepared statements for a majority of its SQL queries (64%) and has a moderate number of nonce and capability checks, these strengths are overshadowed by the numerous critical weaknesses. The large number of unprotected entry points, the prevalence of unsanitized taint flows, and the extensive history of severe vulnerabilities collectively paint a picture of a plugin that requires immediate attention to its security. Continued use of this version without addressing these issues poses a significant risk to WordPress websites.
Key Concerns
- Unprotected AJAX handlers
- Unprotected REST API route
- Dangerous function: unserialize
- High rate of unsanitized taint flows
- Low percentage of properly escaped output
- Past critical CVE
- High number of past high severity CVEs
- Recurring XSS, SQL Injection, and Upload vulnerabilities
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Security Vulnerabilities
CVEs by Year
Severity Breakdown
36 total CVEs
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'
Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter
Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL Injection
Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field
Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file
Form Maker by 10Web <= 1.15.33 - Authenticated (Administrator+) Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.31 - Authenticated (Administrator+) Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.30 - Authenticated (Admin+) Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter
Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.26 - Reflected Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.25 - Authenticated (Admin+) Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.24 - Authenticated (Administrator+) Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.23 - Authenticated (Admin+) Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information Exposure
Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute
Form Maker <= 1.15.20 - Captcha Bypass
Form Maker by 10Web <= 1.15.18 - Unauthenticated Stored Cross-Site Scripting
Form Maker by 10Web <= 1.15.18 - Reflected Cross-Site Scripting
Form Maker by 10Web <= 1.15.19 - Unauthenticated Arbitrary File Upload
Form Maker <= 1.15.16 - Missing Authorization in check_score
Form Maker <= 1.15.5 - Authenticated (Administrator+) SQL Injection
Form Maker <= 1.14.11 - Stored Cross-Site Scripting
Form Maker <= 1.13.59 - Authenticated Stored Cross-Site Scripting
Form Maker by 10Web < 1.13.40 - Reflected Cross-Site Scripting
Form Maker by 10Web <= 1.13.35 - SQL Injection
Form Maker by 10Web <= 1.13.2 - Authenticated SQL Injection
Form Maker by 10Web <= 1.13.4 - Cross-Site Request Forgery to Local File Inclusion
Form Maker by 10Web <= 1.12.21 - CSV Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Release Timeline
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Code Analysis
Dangerous Functions Found
SQL Query Safety
Output Escaping
Data Flow Analysis
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Attack Surface
AJAX Handlers 25
REST API Routes 1
Shortcodes 3
WordPress Hooks 59
Maintenance & Trust
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Maintenance & Trust
Maintenance Signals
Community Trust
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Alternatives
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
everest-forms
The best WordPress form builder. Create contact forms, payment forms, conversational forms, custom forms, surveys, & quizzes using drag and drop.
Contact Form by Supsystic
contact-form-by-supsystic
Contact Form Builder with drag-and-drop editor to create responsive, mobile ready contact forms in a second. Custom fields and contact form templates
NEX-Forms – Ultimate Forms Plugin for WordPress
nex-forms-express-wp-form-builder
Build beautiful responsive forms for WordPress. Contact forms, surveys, quizzes, booking forms, payments, popups & more with NEX-Forms...
FormCraft – Form Builder
formcraft-form-builder
Create gorgeous forms for your site using this drag-and-drop form builder.
Chatterbug Forms – Fast, Flexible WordPress Form Builder
chatterbug-forms
Free unlimited forms and submissions. Create your forms on wp.ChatterbugForms.com for free with easy drag and drop then import them into your site.
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Developer Profile
9 plugins · 355K total installs
How We Detect Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/form-maker/css/bw-ckeditor-widget.css/wp-content/plugins/form-maker/css/bw-ckeditor-widget-dialog.css/wp-content/plugins/form-maker/css/bw-ckeditor-widget.min.css/wp-content/plugins/form-maker/css/datetimepicker/jquery.datetimepicker.css/wp-content/plugins/form-maker/css/daterangepicker.css/wp-content/plugins/form-maker/css/form-maker-admin.css/wp-content/plugins/form-maker/css/form-maker-frontend.css/wp-content/plugins/form-maker/css/form-maker-main.css+60 more/wp-content/plugins/form-maker/js/form-maker.js/wp-content/plugins/form-maker/js/form-maker.min.jsform-maker/css/bw-ckeditor-widget.css?ver=form-maker/css/bw-ckeditor-widget-dialog.css?ver=form-maker/css/bw-ckeditor-widget.min.css?ver=form-maker/css/datetimepicker/jquery.datetimepicker.css?ver=form-maker/css/daterangepicker.css?ver=form-maker/css/form-maker-admin.css?ver=form-maker/css/form-maker-frontend.css?ver=form-maker/css/form-maker-main.css?ver=form-maker/css/form-maker-wizard.css?ver=form-maker/css/form-maker-wizard.min.css?ver=form-maker/css/jquery.datepick.css?ver=form-maker/css/jquery.fileuploader.css?ver=form-maker/css/jquery-ui-1.10.3.custom.css?ver=form-maker/css/colorbox/colorbox.css?ver=form-maker/framework/js/wd-colorbox.js?ver=form-maker/framework/js/wd-form-fields-checker.js?ver=form-maker/framework/js/wd-form-fields-validation.js?ver=form-maker/framework/js/wd-form-fields-validation.min.js?ver=form-maker/framework/js/wd-plugin-settings.js?ver=form-maker/framework/js/wd-plugin-settings.min.js?ver=form-maker/js/admin.js?ver=form-maker/js/admin.min.js?ver=form-maker/js/bw-ckeditor-widget.js?ver=form-maker/js/bw-ckeditor-widget.min.js?ver=form-maker/js/datetimepicker/jquery.datetimepicker.js?ver=form-maker/js/daterangepicker.js?ver=form-maker/js/form-maker-frontend.js?ver=form-maker/js/form-maker-frontend.min.js?ver=form-maker/js/form-maker-wizard.js?ver=form-maker/js/form-maker-wizard.min.js?ver=form-maker/js/jquery.fileuploader.js?ver=form-maker/js/colorbox/jquery.colorbox-min.js?ver=form-maker/js/colorbox/jquery.colorbox.js?ver=form-maker/js/forms-generator.js?ver=form-maker/js/forms-generator.min.js?ver=form-maker/js/jquery.number.min.js?ver=form-maker/js/jquery.number.js?ver=form-maker/js/jquery-ui-1.10.3.custom.min.js?ver=form-maker/js/jquery-ui-1.10.3.custom.js?ver=form-maker/js/jquery.datepick.min.js?ver=form-maker/js/jquery.datepick.js?ver=form-maker/js/numeric.js?ver=form-maker/js/numeric.min.js?ver=form-maker/js/form-maker-main.js?ver=form-maker/js/form-maker-main.min.js?ver=form-maker/js/jquery.simple-colorpicker.js?ver=form-maker/js/jquery.simple-colorpicker.min.js?ver=form-maker/js/jquery.numeric.js?ver=form-maker/js/jquery.numeric.min.js?ver=form-maker/js/form-maker-wizard-admin.js?ver=form-maker/js/form-maker-wizard-admin.min.js?ver=form-maker/js/admin-form-maker.js?ver=form-maker/js/admin-form-maker.min.js?ver=form-maker/js/form-maker-admin-functions.js?ver=form-maker/js/form-maker-admin-functions.min.js?ver=form-maker/js/form-maker-functions.js?ver=form-maker/js/form-maker-functions.min.js?ver=form-maker/js/form-maker.js?ver=form-maker/js/form-maker.min.js?ver=form-maker/js/ckeditor/ckeditor.js?ver=form-maker/js/jquery.maskedinput.js?ver=form-maker/js/jquery.maskedinput.min.js?ver=form-maker/js/jquery.tipsy.js?ver=form-maker/js/jquery.tipsy.min.js?ver=form-maker/js/jquery-cookie.js?ver=form-maker/js/jquery-cookie.min.js?ver=form-maker/js/colorpicker.js?ver=form-maker/js/colorpicker.min.js?ver=HTML / DOM Fingerprints
wdformform-makerfm-containerfm-elementwdform_rowwdform-column<!-- WDFM --><!-- form-maker -->data-form-idwdform_processorwdform_paramswdform_fields_validation_paramswdform_fields_checker_paramsfm_date_formatfm_date_time_format+6 more/wp-json/form-maker/v1[form-maker[forminator_form