# 10Web vulnerabilities Source: https://junglewise.ai/threats/vendors/10web Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/10web.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 39 vulnerabilities in 10Web: 5 in the last 7 days and 28 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110072, was published on 12 November 2026. 7 vulnerabilities in the last four weeks, down 53% on the four before (15). 3 technologies have a page of their own. ## Counts - Last 7 days: 5 - Last 30 days: 8 - Last 90 days: 28 - All time: 39 (2 critical, 0 exploited in the wild) ## About 10Web 10Web is a software company that provides a managed WordPress hosting platform and website building tools. ## Latest 10Web vulnerabilities - [CVE-2026-110072: Photo Gallery by 10Web stored cross-site scripting in watermark attribute](https://junglewise.ai/threats/cve-2026-110072-the-photo-gallery-by-10web-wordpress-plugin-before-1-8-49-does) (info, published 12 Nov 2026) - [CVE-2026-119483: 10Web Form Maker stored cross-site scripting (XSS)](https://junglewise.ai/threats/cve-2026-119483-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-104760: weDocs WordPress plugin stored cross-site scripting in modalPlaceholder](https://junglewise.ai/threats/cve-2026-104760-the-wedocs-ai-powered-knowledge-base-docs-documentation-wiki-ai) (medium, CVSS 6.4, published 7 Nov 2026) - [CVE-2026-120512: Form Maker by 10Web stored XSS in hidden input field](https://junglewise.ai/threats/cve-2026-120512-the-form-maker-by-10web-mobile-friendly-drag-drop-contact-form) (high, CVSS 7.2, published 7 Nov 2026) - [CVE-2026-118067: 10Web Form Maker stored cross-site scripting in form submissions](https://junglewise.ai/threats/cve-2026-118067-the-form-maker-by-10web-mobile-friendly-drag-drop-contact-form) (medium, CVSS 5.4, published 7 Nov 2026) - [CVE-2026-105413: Form Maker by 10Web stored XSS in submission fields](https://junglewise.ai/threats/cve-2026-105413-the-form-maker-by-10web-wordpress-plugin-before-1-15-51-does-not) (info, published 4 Nov 2026) - [CVE-2026-118081: 10Web Social Photo Feed PHP Object Injection](https://junglewise.ai/threats/cve-2026-118081-contributor-php-object-injection-in-10web-social-photo-feed-1-5) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-103896: 10Web Booster WordPress plugin path traversal file write](https://junglewise.ai/threats/cve-2026-103896-the-10web-booster-website-speed-optimization-cache-page-speed) (high, CVSS 7.5, published 16 Oct 2026) - [CVE-2026-107423: WP User Manager broken access control in user pages](https://junglewise.ai/threats/cve-2026-107423-missing-authorization-vulnerability-in-wp-user-manager-wp-user) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-42715: Photo Gallery by 10Web unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-42715-unauthenticated-cross-site-scripting-xss-in-photo-gallery-by) (high, CVSS 7.1, published 10 Oct 2026) - [CVE-2026-42711: Slider by 10Web unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-42711-unauthenticated-cross-site-scripting-xss-in-slider-by-10web-1-2) (high, CVSS 7.1, published 10 Oct 2026) - [CVE-2026-105885: 10Web Slider by 10Web PHP object injection](https://junglewise.ai/threats/cve-2026-105885-deserialization-of-untrusted-data-vulnerability-in-10web-slider) (high, CVSS 8.8, published 10 Oct 2026) - [CVE-2026-107742: 10Web Booster stored cross-site scripting in author parameter](https://junglewise.ai/threats/cve-2026-107742-the-10web-booster-website-speed-optimization-cache-page-speed) (high, CVSS 7.2, published 10 Oct 2026) - [CVE-2026-103998: Form Maker by 10Web reflected cross-site script in inputs parameter](https://junglewise.ai/threats/cve-2026-103998-the-form-maker-by-10web-mobile-friendly-drag-drop-contact-form) (medium, CVSS 6.1, published 10 Oct 2026) - [CVE-2026-102401: Download Manager plugin for WordPress stored XSS via regurl parameter](https://junglewise.ai/threats/cve-2026-102401-the-download-manager-plugin-for-wordpress-is-vulnerable-to) (medium, CVSS 6.4, published 10 Oct 2026) - [CVE-2026-39787: 10Web Social Photo Feed broken access control](https://junglewise.ai/threats/cve-2026-39787-unauthenticated-broken-access-control-in-10web-social-photo-feed) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-92974: Photo Gallery by 10Web reflected XSS via thumb_url parameter](https://junglewise.ai/threats/cve-2026-92974-the-photo-gallery-by-10web-mobile-friendly-image-gallery-plugin) (medium, CVSS 6.1, published 3 Oct 2026) - [CVE-2026-96813: Form Maker by 10Web stored XSS in map longitude/latitude fields](https://junglewise.ai/threats/cve-2026-96813-the-form-maker-by-10web-mobile-friendly-drag-drop-contact-form) (high, CVSS 7.2, published 1 Oct 2026) - [CVE-2026-102377: Photo Gallery by 10Web PHP object injection](https://junglewise.ai/threats/cve-2026-102377-contributor-php-object-injection-in-photo-gallery-by-10web-1-8) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-94121: 10Web Booster PHP Object Injection in cache optimizer](https://junglewise.ai/threats/cve-2026-94121-contributor-php-object-injection-in-10web-booster-website-speed) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-19708: File Manager WordPress plugin unauthenticated backup disclosure](https://junglewise.ai/threats/cve-2026-19708-the-file-manager-wordpress-plugin-before-8-0-5-does-not-prevent) (info, published 26 Sep 2026) - [CVE-2026-82195: 10Web Booster unauthenticated secret disclosure in cloud connection](https://junglewise.ai/threats/cve-2026-82195-the-10web-booster-wordpress-plugin-before-2-34-0-does-not) (medium, CVSS 6.5, published 24 Sep 2026) - [CVE-2026-85652: 10Web Photo Gallery time-based SQL injection in album_id shortcode attribute](https://junglewise.ai/threats/cve-2026-85652-10web-photo-gallery-time-based-sql-injection-in-album-id) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-86311: Photo Gallery by 10Web stored cross-site scripting in shortcode attributes](https://junglewise.ai/threats/cve-2026-86311-photo-gallery-by-10web-stored-cross-site-scripting-in-shortcode) (medium, CVSS 6.4, published 17 Sep 2026) - [CVE-2026-85645: 10Web Form Maker reflected XSS in bulk_action parameter](https://junglewise.ai/threats/cve-2026-85645-10web-form-maker-reflected-xss-in-bulk-action-parameter) (medium, CVSS 6.1, published 10 Sep 2026) ## Most severe 10Web vulnerabilities - [CVE-2025-13377: The 10Web Booster , Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to…](https://junglewise.ai/threats/cve-2025-13377-the-10web-booster-website-speed-optimization-cache-page-speed) (critical, CVSS 9.6, published 6 Dec 2025) - [CVE-2026-39502: 10Web Form Maker SQL injection](https://junglewise.ai/threats/cve-2026-39502-10web-form-maker-sql-injection) (critical, CVSS 9.3, published 15 Jun 2026) - [CVE-2026-105885: 10Web Slider by 10Web PHP object injection](https://junglewise.ai/threats/cve-2026-105885-deserialization-of-untrusted-data-vulnerability-in-10web-slider) (high, CVSS 8.8, published 10 Oct 2026) - [CVE-2026-118081: 10Web Social Photo Feed PHP Object Injection](https://junglewise.ai/threats/cve-2026-118081-contributor-php-object-injection-in-10web-social-photo-feed-1-5) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-102377: Photo Gallery by 10Web PHP object injection](https://junglewise.ai/threats/cve-2026-102377-contributor-php-object-injection-in-photo-gallery-by-10web-1-8) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-94121: 10Web Booster PHP Object Injection in cache optimizer](https://junglewise.ai/threats/cve-2026-94121-contributor-php-object-injection-in-10web-booster-website-speed) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-16977: 10Web Form Maker SQL injection via display_name](https://junglewise.ai/threats/cve-2026-16977-10web-form-maker-sql-injection-via-display-name) (high, CVSS 8.1, published 12 Aug 2026) - [CVE-2026-49771: 10Web Photo Gallery SQL injection](https://junglewise.ai/threats/cve-2026-49771-10web-photo-gallery-sql-injection) (high, CVSS 7.6, published 4 Jun 2026) - [CVE-2026-103896: 10Web Booster WordPress plugin path traversal file write](https://junglewise.ai/threats/cve-2026-103896-the-10web-booster-website-speed-optimization-cache-page-speed) (high, CVSS 7.5, published 16 Oct 2026) - [CVE-2026-96813: Form Maker by 10Web stored XSS in map longitude/latitude fields](https://junglewise.ai/threats/cve-2026-96813-the-form-maker-by-10web-mobile-friendly-drag-drop-contact-form) (high, CVSS 7.2, published 1 Oct 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, down 53% on the four before (15). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 4 | 0 | 0 | | 5 Oct 2026 | 7 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 4 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## 10Web technologies - [10Web Form-Maker](https://junglewise.ai/threats/technologies/form-maker): 14 vulnerabilities - [10Web Photo Gallery](https://junglewise.ai/threats/technologies/photo-gallery): 8 vulnerabilities - [10web Booster](https://junglewise.ai/threats/technologies/10web-booster): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "10Web vulnerabilities", https://junglewise.ai/threats/vendors/10web, 13 November 2026.