Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

81 Quality Score

Active Installs

20/30

Popularity scored 67/30, reflecting roughly 30,000 active installs which is modest compared to WPForms Lite (5M) or Forminator (600K).

Update Freshness

25/25

Maintenance scored a perfect 100/25, with the plugin last updated June 2026 and tested against WordPress 6.9.4.

User Rating

14/15

User ratings scored 90/15, based on 776 reviews averaging a strong 4.5 out of 5.

Support Health

8/15

Support health scored only 50/15, as the plugin shows 0 resolved support threads out of 0 total, indicating no measurable track record of helping users in the public forum.

WP Compatibility

15/15

Compatibility scored a perfect 100/15, requiring only WordPress 4.6 and no specified PHP version, making it broadly installable.

Scores higher than 84% of indexed plugins

About

Form Maker is a user-friendly contact form builder that allows to create forms for any purpose, from a simple contact form to multi page survey forms

Active Installs 30k+

Rating ★★★★½ 4.5/5

Last Updated 2026-09-08 12:15pm GMT

Requires WordPress 4.6+

Tested Up To 7.0.4

Security History

43 known vulnerabilities, all patched

1 Critical 13 High 29 Medium

Most recent: September 9, 2026

View details ▸

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting Medium

September 9, 2026 Patched in ["1.15.47"] CVE-2026-85645

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Unauthenticated Stored Cross-Site Scripting High

August 19, 2026 Patched in [] CVE-2026-66616

Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause Medium

August 14, 2026 Patched in ["1.15.45"] CVE-2026-15993

Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection Medium

August 10, 2026 Patched in ["1.15.45"] CVE-2026-16977

Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter Medium

June 17, 2026 Patched in ["1.15.44"] CVE-2026-11776

Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter Medium

June 17, 2026 Patched in ["1.15.44"] CVE-2026-11777

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs' High

May 4, 2026 Patched in ["1.15.43"] CVE-2026-3359

Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter Medium

April 16, 2026 Patched in ["1.15.41"] CVE-2026-3330

Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box High

April 13, 2026 Patched in ["1.15.41"] CVE-2026-4388

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection High

April 8, 2026 Patched in ["1.15.39"] CVE-2026-39502

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL Injection High

March 23, 2026 Patched in ["1.15.38"] CVE-2025-15441

Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field High

February 2, 2026 Patched in ["1.15.36"] CVE-2026-1058

Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file High

February 2, 2026 Patched in ["1.15.36"] CVE-2026-1065

Form Maker by 10Web <= 1.15.33 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

May 19, 2025 Patched in ["1.15.34"] CVE-2025-48341

Form Maker by 10Web <= 1.15.31 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

March 26, 2025 Patched in ["1.15.32"] CVE-2024-10680

Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

March 3, 2025 Patched in ["1.15.30"] CVE-2024-10560

Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

March 2, 2025 Patched in ["1.15.30"] CVE-2024-10558

Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

February 7, 2025 Patched in ["1.15.33"] CVE-2024-13053

Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

February 3, 2025 Patched in ["1.15.33"] CVE-2024-13605

Form Maker by 10Web <= 1.15.30 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

December 17, 2024 Patched in ["1.15.31"] CVE-2024-10562

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Medium

December 3, 2024 Patched in ["1.15.28"] CVE-2024-5020

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter Medium

November 10, 2024 Patched in ["1.15.31"] CVE-2024-10265

Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

September 25, 2024 Patched in ["1.15.28"] CVE-2024-8633

Form Maker by 10Web <= 1.15.26 - Reflected Cross-Site Scripting Medium

August 9, 2024 Patched in ["1.15.27"] CVE-2024-43220

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.25 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

June 10, 2024 Patched in ["1.15.26"] CVE-2024-6130

Form Maker by 10Web <= 1.15.24 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

May 7, 2024 Patched in ["1.15.25"] CVE-2024-34437

Form Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting Medium

April 26, 2024 Patched in ["1.15.25"] CVE-2024-2258

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.23 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

April 15, 2024 Patched in ["1.15.24"] CVE-2024-32534

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information Exposure Medium

March 22, 2024 Patched in ["1.15.23"] CVE-2024-2112

Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute Medium

January 26, 2024 Patched in ["1.15.22"] CVE-2024-0667

Form Maker <= 1.15.20 - Captcha Bypass Medium

October 11, 2023 Patched in ["1.15.21"] CVE-2023-48290

Form Maker by 10Web <= 1.15.18 - Unauthenticated Stored Cross-Site Scripting High

October 3, 2023 Patched in ["1.15.19"] CVE-2023-45071

Form Maker by 10Web <= 1.15.18 - Reflected Cross-Site Scripting Medium

October 3, 2023 Patched in ["1.15.19"] CVE-2023-45070

Form Maker by 10Web <= 1.15.19 - Unauthenticated Arbitrary File Upload Critical

September 7, 2023 Patched in ["1.15.20"] CVE-2023-4666

Form Maker <= 1.15.16 - Missing Authorization in check_score Medium

June 14, 2023 Patched in ["1.15.17"]

Form Maker <= 1.15.5 - Authenticated (Administrator+) SQL Injection High

September 29, 2022 Patched in ["1.15.6"] CVE-2022-3300

Form Maker <= 1.14.11 - Stored Cross-Site Scripting Medium

May 9, 2022 Patched in ["1.14.12"] CVE-2022-1564

Form Maker <= 1.13.59 - Authenticated Stored Cross-Site Scripting Medium

July 15, 2021 Patched in ["1.13.60"] CVE-2021-24526

Form Maker by 10Web < 1.13.40 - Reflected Cross-Site Scripting Medium

July 12, 2020 Patched in ["1.13.40"]

Form Maker by 10Web <= 1.13.35 - SQL Injection High

May 26, 2020 Patched in ["1.13.36"]

Form Maker by 10Web <= 1.13.2 - Authenticated SQL Injection High

May 10, 2019 Patched in ["1.13.3"] CVE-2019-10866

Form Maker by 10Web <= 1.13.4 - Cross-Site Request Forgery to Local File Inclusion High

April 5, 2019 Patched in ["1.13.5"] CVE-2019-11590

Form Maker by 10Web <= 1.12.21 - CSV Injection High

April 27, 2018 Patched in ["1.12.22"] CVE-2018-10504

What It Does

Form Maker by 10Web is a drag-and-drop form builder plugin that lets you create contact forms, surveys, payment forms, and registration pages directly from the WordPress dashboard without coding. It supports multi-page forms, conditional logic, and integrations with email marketing services and payment gateways.

Who It's For

This plugin fits small business owners, agencies, and nonprofits who need a flexible form builder with a generous free tier and do not mind a moderately complex interface. It is well suited for sites that want to build a variety of forms (contact, booking, survey, donation) from a single plugin without installing several add-ons.

Who Should Skip It

Users who want a lightweight contact form with minimal setup should skip this plugin and use WPForms Lite or Contact Form 7 instead. Sites needing reliable, responsive developer support should also avoid it given the zero resolved support threads on record.

The Bottom Line

Form Maker is a competent, actively maintained form builder with excellent ratings and broad compatibility, but its modest install count and absence of resolved public support threads make it a riskier choice than WPForms Lite or Forminator. The zero-resolved support stat is the biggest red flag and worth weighing carefully before committing to it on a production site.

Pick Akismet if spam filtering, not form building, is your actual problem.

WPForms Lite 97/100

Pick WPForms Lite if you want a friendlier UI, a massive install base, and reliable support for simple contact and payment forms.

Forminator Forms 94/100

Pick Forminator if you need similar drag-and-drop functionality with 20x more installs and stronger community validation.

MC4WP: Mailchimp for WordPress 89/100

Pick Mailchimp for WordPress if Mailchimp newsletter signups are your primary use case and you do not need full form-building features.

Fluent Forms 88/100

Pick Fluent Forms if you want conversational forms, quizzes, and a modern UI with a much larger active user base.