https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-13377.htmlhttps://patchthecve.com/cve/CVE-2025-13377.htmlThu, 15 Oct 2026 20:10:00 +0000CRITICAL 9.6: The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possiblehttps://patchthecve.com/cve/CVE-2024-8670.htmlhttps://patchthecve.com/cve/CVE-2024-8670.htmlWed, 17 Jun 2026 08:23:05 +0000MEDIUM 4.8: The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-13053.htmlhttps://patchthecve.com/cve/CVE-2024-13053.htmlWed, 17 Jun 2026 07:01:04 +0000MEDIUM 4.8: The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-10680.htmlhttps://patchthecve.com/cve/CVE-2024-10680.htmlWed, 17 Jun 2026 06:56:11 +0000MEDIUM 4.8: The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2025-0613.htmlhttps://patchthecve.com/cve/CVE-2025-0613.htmlWed, 17 Jun 2026 08:26:50 +0000MEDIUM 6.1: The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayedhttps://patchthecve.com/cve/CVE-2024-10566.htmlhttps://patchthecve.com/cve/CVE-2024-10566.htmlWed, 17 Jun 2026 06:55:56 +0000MEDIUM 6.1: The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-10565.htmlhttps://patchthecve.com/cve/CVE-2024-10565.htmlWed, 17 Jun 2026 06:55:56 +0000MEDIUM 6.1: The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-10560.htmlhttps://patchthecve.com/cve/CVE-2024-10560.htmlWed, 17 Jun 2026 06:55:56 +0000LOW 3.5: The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-13124.htmlhttps://patchthecve.com/cve/CVE-2024-13124.htmlWed, 17 Jun 2026 07:01:15 +0000LOW 3.5: The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-10558.htmlhttps://patchthecve.com/cve/CVE-2024-10558.htmlWed, 17 Jun 2026 06:55:55 +0000LOW 3.5: The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-13605.htmlhttps://patchthecve.com/cve/CVE-2024-13605.htmlWed, 17 Jun 2026 07:02:21 +0000MEDIUM 4.8: The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-10562.htmlhttps://patchthecve.com/cve/CVE-2024-10562.htmlWed, 17 Jun 2026 06:55:56 +0000LOW 2.7: The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2023-47807.htmlhttps://patchthecve.com/cve/CVE-2023-47807.htmlWed, 17 Jun 2026 06:33:19 +0000MEDIUM 4.3: Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10WebAnalytics: from n/a through <= 1.2.12.https://patchthecve.com/cve/CVE-2023-45272.htmlhttps://patchthecve.com/cve/CVE-2023-45272.htmlWed, 17 Jun 2026 06:28:33 +0000MEDIUM 5.4: Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.73.https://patchthecve.com/cve/CVE-2023-33995.htmlhttps://patchthecve.com/cve/CVE-2023-33995.htmlWed, 17 Jun 2026 06:02:41 +0000MEDIUM 4.3: Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.https://patchthecve.com/cve/CVE-2024-10704.htmlhttps://patchthecve.com/cve/CVE-2024-10704.htmlWed, 17 Jun 2026 06:56:13 +0000MEDIUM 4.8: The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-10265.htmlhttps://patchthecve.com/cve/CVE-2024-10265.htmlWed, 17 Jun 2026 06:55:17 +0000MEDIUM 6.1: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for unauthentihttps://patchthecve.com/cve/CVE-2024-9878.htmlhttps://patchthecve.com/cve/CVE-2024-9878.htmlWed, 17 Jun 2026 08:25:25 +0000MEDIUM 4.4: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,https://patchthecve.com/cve/CVE-2024-9630.htmlhttps://patchthecve.com/cve/CVE-2024-9630.htmlWed, 17 Jun 2026 08:24:56 +0000MEDIUM 5.4: The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API.https://patchthecve.com/cve/CVE-2024-9628.htmlhttps://patchthecve.com/cve/CVE-2024-9628.htmlWed, 17 Jun 2026 08:24:56 +0000MEDIUM 6.3: The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Telegram_Chat_Admin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, withttps://patchthecve.com/cve/CVE-2024-9607.htmlhttps://patchthecve.com/cve/CVE-2024-9607.htmlWed, 17 Jun 2026 08:24:54 +0000MEDIUM 6.1: The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts inhttps://patchthecve.com/cve/CVE-2024-5968.htmlhttps://patchthecve.com/cve/CVE-2024-5968.htmlWed, 17 Jun 2026 08:17:00 +0000MEDIUM 4.8: The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in muhttps://patchthecve.com/cve/CVE-2024-44043.htmlhttps://patchthecve.com/cve/CVE-2024-44043.htmlWed, 17 Jun 2026 07:52:12 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.27.https://patchthecve.com/cve/CVE-2024-8283.htmlhttps://patchthecve.com/cve/CVE-2024-8283.htmlWed, 17 Jun 2026 08:22:17 +0000MEDIUM 4.8: The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-8633.htmlhttps://patchthecve.com/cve/CVE-2024-8633.htmlWed, 17 Jun 2026 08:23:01 +0000MEDIUM 5.5: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, whttps://patchthecve.com/cve/CVE-2024-43220.htmlhttps://patchthecve.com/cve/CVE-2024-43220.htmlWed, 17 Jun 2026 07:50:37 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Reflected XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.26.https://patchthecve.com/cve/CVE-2024-7150.htmlhttps://patchthecve.com/cve/CVE-2024-7150.htmlWed, 17 Jun 2026 08:19:26 +0000HIGH 8.8: The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. https://patchthecve.com/cve/CVE-2024-6408.htmlhttps://patchthecve.com/cve/CVE-2024-6408.htmlWed, 17 Jun 2026 08:17:57 +0000MEDIUM 5.4: The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowedhttps://patchthecve.com/cve/CVE-2024-6272.htmlhttps://patchthecve.com/cve/CVE-2024-6272.htmlWed, 17 Jun 2026 08:17:40 +0000MEDIUM 6.1: The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminhttps://patchthecve.com/cve/CVE-2024-6026.htmlhttps://patchthecve.com/cve/CVE-2024-6026.htmlWed, 17 Jun 2026 08:17:08 +0000MEDIUM 5.4: The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access to the Sliders (by default Administrator, however this can be changed via the Slider by 10Web WordPress plugin before 1.2.56's options) and thttps://patchthecve.com/cve/CVE-2024-6130.htmlhttps://patchthecve.com/cve/CVE-2024-6130.htmlWed, 17 Jun 2026 08:17:21 +0000MEDIUM 4.8: The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)