Skip to content
PluginCanary

Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder

by 10Web · 30,000+ active installs · Checked 3 Nov 2026
Watch7 Warnings

Watch: vulnerability published 13 Oct 2026, fixed in 1.15.49.

71/ 100 Canary Score
Sub-scores for Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder
Ownership100
Maintenance100
Security60
Support0
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 13 Oct 2026, fixed in 1.15.49. Update to version 1.15.49 or later.13 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 1.15.49. Update to version 1.15.49 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Sep 2026, fixed in 1.15.48. Update to version 1.15.48 or later.30 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 9 Sep 2026, fixed in 1.15.47. Update to version 1.15.47 or later.9 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 19 Aug 2026, fixed in 1.15.50. Update to version 1.15.50 or later.19 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 14 Aug 2026, fixed in 1.15.45. Update to version 1.15.45 or later.14 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 10 Aug 2026, fixed in 1.15.45. Update to version 1.15.45 or later.10 Aug 2026Evidence
  • InfoSEC-325 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
webdorado4 Apr 2012 to 12 Jan 2021, 666 commits
10web11 May 2019 to 8 Sep 2026, 239 commits
smbat10web28 Sep 2026 to 30 Oct 2026, 8 commits

New committer smbat10web made a first commit on 28 Sep 2026.

Maintenance

Last release
5 days ago
Releases, 24 months
21
Tested up to
7.0 vs 7.1
Requires PHP
not stated supported 8.2+
Releases per quarter for Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder
Q1 20243
Q2 20242
Q3 20242
Q4 20244
Q1 20251
Q2 20251
Q3 20250
Q4 20250
Q1 20266
Q2 20264
Q3 20264
Q4 20263

Last release 30 Oct 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Support

0% of 8 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
13 Oct 2026Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter7.5<= 1.15.481.15.490
9 Oct 2026Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key6.1<= 1.15.481.15.490
30 Sep 2026Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields7.2<= 1.15.471.15.480
9 Sep 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting6.1<= 1.15.461.15.470
19 Aug 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.49 - Unauthenticated Stored Cross-Site Scripting7.2<= 1.15.491.15.5057
14 Aug 2026Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause5.3<= 1.15.441.15.450
10 Aug 2026Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection6.5<= 1.15.441.15.450
17 Jun 2026Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter4.9<= 1.15.431.15.440
17 Jun 2026Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter4.9<= 1.15.431.15.440
4 May 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'7.5<= 1.15.421.15.430
16 Apr 2026Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter4.9<= 1.15.401.15.410
13 Apr 2026Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box7.2<= 1.15.401.15.410
8 Apr 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection7.5<= 1.15.381.15.390
23 Mar 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL Injection7.5< 1.15.381.15.380
2 Feb 2026Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field7.1<= 1.15.351.15.360
2 Feb 2026Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file7.2<= 1.15.351.15.360
19 May 2025Form Maker by 10Web <= 1.15.33 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 1.15.331.15.3423
26 Mar 2025Form Maker by 10Web <= 1.15.31 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5<= 1.15.311.15.320
3 Mar 2025Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 1.15.291.15.300
2 Mar 2025Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 1.15.291.15.300
7 Feb 2025Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 1.15.321.15.330
3 Feb 2025Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 1.15.321.15.330
17 Dec 2024Form Maker by 10Web <= 1.15.30 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 1.15.301.15.310
3 Dec 2024Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library6.4<= 1.15.271.15.280
10 Nov 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter6.1<= 1.15.301.15.310

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder
Q1 20243.7
Q3 20245.0
Q1 20265.0
Q3 20262.5
Q4 20262.0

Average rating fell from 3.7 to 2.0 between Q1 2024 and Q4 2026.

Rating distribution
5 star623
4 star52
3 star15
2 star18
1 star70
Latest low reviews

Momentum

30,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder
4 May 20261,033
11 May 20261,639
18 May 20261,852
25 May 20261,123
1 Jun 20261,037
8 Jun 202610,583
15 Jun 20262,320
22 Jun 20261,592
29 Jun 20261,281
6 Jul 20261,724
13 Jul 20261,108
20 Jul 20261,094
27 Jul 20261,039
3 Aug 202611,770
10 Aug 20261,961
17 Aug 202611,776
24 Aug 20262,227
31 Aug 20261,588
7 Sep 202610,795
14 Sep 20262,372
21 Sep 20261,744
28 Sep 202611,713
5 Oct 202612,171
12 Oct 202610,973
19 Oct 20262,824
26 Oct 202611,551
2 Nov 2026673

Weekly downloads over the last 4 weeks are 44% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - JotformScore 91 · 20,000+Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & MoreScore 91 · 10,000+Contact Form Clean and SimpleScore 91 · 7,000+Formzu WPScore 91 · 3,000+Woorise - Forms, Quizzes & GiveawaysScore 91 · 1,000+

Facts

Version1.15.51
Author10Web
Added4 Apr 2012
Last updated30 Oct 2026
Active installs30,000+
Requires WordPress4.6
Tested up to7.0.8
Requires PHPnot stated
CategoryForms & Data Collection > Form Builders & Creators
Tagsform, survey, contact form, form builder, form manager

Other plugins by this author: Photo Gallery by 10Web - Mobile-Friendly Image Gallery, 10Web Booster - Website speed optimization, Cache & Page Speed optimizer, Slider by 10Web - Responsive Image Slider, 10WebSocial, Image Optimizer by 10web - Image Optimizer and Compression plugin, Import to Photo Gallery from NextGen gallery, Z

Questions

Is Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder still maintained?

Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder was last updated on 30 Oct 2026. Its Canary status is Watch.

Is Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder safe?

Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder has no open unpatched vulnerabilities on record. 25 vulnerabilities were published in the last 24 months. Its Canary status is Watch.

Who owns Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder?

The wordpress.org author is 10Web. Recent committers: smbat10web, 10web, webdorado, plugin-master. New committer smbat10web made a first commit on 28 Sep 2026.

What can I use instead of Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder?

Plugins in the same category with a higher Canary Score: Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - Jotform, Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & More, Contact Form Clean and Simple, Formzu WP, Woorise - Forms, Quizzes & Giveaways.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue