Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 79% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. The recent download trend is too spiky to read.

1. ★★★★★ Havyarimana Fabien

   2mo ago

   It works well both on mobile and desktop devices and compatible with WordPress plugins and themes.

   Read on wp.org ↗
2. ★★★★★ wireB

   7mo ago

   Is there a PDF form filler?

   Read on wp.org ↗
3. ★★★★★ robert433

   1.9y ago

   My partner complained about the huge spam emails received from the contact page. I initially thought of hiring a freelancer to add some kind of human validation for the Contact 7 form. Then I searched the website and found this plugin WP Image CAPTCHA. After I installed and activated it, add those two words per the instruction, and then I got the working contact 7 form with WP Image CAPTCHA. Very easy to add. Thanks a lot!

   Read on wp.org ↗
4. ★★★★★ donademadona

   2.4y ago

   Good plugin

   Read on wp.org ↗
5. ★★★★★ dvelkov

   2.5y ago

   On their page you will find a option to “Buy Now”, but it does not clearly states that you are SUBSCRIBING for a 6 month billing period. When you ask for a refund: “No refund is provided. There is a 7 day free trial.”. You can be sure that nowhere on the page you can “Free trial” button or option. So I paid for the full function, saw it does not work for me as the added functionality is very small. So now I am stuck with a useless PREMIUN version! |ZERO STARS!!!

   Read on wp.org ↗
6. ★★★★★ shakedown1979

   2.6y ago

   Very simple, yet effective. The customization if fails easy too.

   Read on wp.org ↗
7. ★★★★★ s4mr4t

   3.0y ago

   good

   Read on wp.org ↗
8. ★★★★★ Marisa Salinas

   3.1y ago

   Lots of options and very customizable.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.15.44 Fixed: Security issues. 1.15.44
2. — Version 1.15.43 Fixed: Security issue. 1.15.43
3. — Version 1.15.42 Fixed: Security issue. 1.15.42
4. — Version 1.15.41 Fixed: Security issues. 1.15.41
5. — Version 1.15.40 Fixed: Security issue. 1.15.40
6. — Version 1.15.39 Fixed: Security issue. 1.15.39

42 disclosed vulnerabilities on record for this plugin, 1 still affects the current version.

1. High · 7.2 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-08-19 CVE-2026-66616 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.46 No patch available
2. Medium · 5.3 Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause ↗
   2026-08-14 CVE-2026-15993 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.15.44 Patched in 1.15.45
3. Medium · 6.5 Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection ↗
   2026-08-10 CVE-2026-16977 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.15.44 Patched in 1.15.45
4. Medium · 4.9 Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter ↗
   2026-06-17 CVE-2026-11776 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.15.43 Patched in 1.15.44
5. Medium · 4.9 Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter ↗
   2026-06-17 CVE-2026-11777 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.15.43 Patched in 1.15.44
6. High · 7.5 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs' ↗
   2026-05-04 CVE-2026-3359 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.15.42 Patched in 1.15.43
7. Medium · 4.9 Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter ↗
   2026-04-16 CVE-2026-3330 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.15.40 Patched in 1.15.41
8. High · 7.2 Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box ↗
   2026-04-13 CVE-2026-4388 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.40 Patched in 1.15.41
9. High · 7.5 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection ↗
   2026-04-08 CVE-2026-39502 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.15.38 Patched in 1.15.39
10. High · 7.5 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL Injection ↗
    2026-03-23 CVE-2025-15441 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.15.38 Patched in 1.15.38
11. High · 7.1 Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field ↗
    2026-02-02 CVE-2026-1058 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.35 Patched in 1.15.36
12. High · 7.2 Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file ↗
    2026-02-02 CVE-2026-1065 Unrestricted Upload of File with Dangerous Type Affects <= 1.15.35 Patched in 1.15.36
13. Medium · 4.4 Form Maker by 10Web <= 1.15.33 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2025-05-19 CVE-2025-48341 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.33 Patched in 1.15.34
14. Medium · 5.5 Form Maker by 10Web <= 1.15.31 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2025-03-26 CVE-2024-10680 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.31 Patched in 1.15.32
15. Medium · 4.4 Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-03-03 CVE-2024-10560 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.29 Patched in 1.15.30
16. Medium · 4.4 Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-03-02 CVE-2024-10558 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.29 Patched in 1.15.30
17. Medium · 4.4 Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-02-07 CVE-2024-13053 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.32 Patched in 1.15.33
18. Medium · 4.4 Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-02-03 CVE-2024-13605 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.32 Patched in 1.15.33
19. Medium · 4.4 Form Maker by 10Web <= 1.15.30 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-12-17 CVE-2024-10562 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.30 Patched in 1.15.31
20. Medium · 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library ↗
    2024-12-03 CVE-2024-5020 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.27 Patched in 1.15.28
21. Medium · 6.1 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter ↗
    2024-11-10 CVE-2024-10265 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.30 Patched in 1.15.31
22. Medium · 5.5 Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-09-25 CVE-2024-8633 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.27 Patched in 1.15.28
23. Medium · 6.1 Form Maker by 10Web <= 1.15.26 - Reflected Cross-Site Scripting ↗
    2024-08-09 CVE-2024-43220 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.26 Patched in 1.15.27
24. Medium · 4.4 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.25 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-06-10 CVE-2024-6130 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.25 Patched in 1.15.26
25. Medium · 4.4 Form Maker by 10Web <= 1.15.24 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-05-07 CVE-2024-34437 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.24 Patched in 1.15.25
26. Medium · 4.4 Form Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting ↗
    2024-04-26 CVE-2024-2258 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.24 Patched in 1.15.25
27. Medium · 4.4 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.23 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-04-15 CVE-2024-32534 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.23 Patched in 1.15.24
28. Medium · 5.9 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information Exposure ↗
    2024-03-22 CVE-2024-2112 Improper Authentication Affects <= 1.15.22 Patched in 1.15.23
29. Medium · 5.4 Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute ↗
    2024-01-26 CVE-2024-0667 Inappropriate Source Code Style or Formatting Affects <= 1.15.21 Patched in 1.15.22
30. Medium · 5.3 Form Maker <= 1.15.20 - Captcha Bypass ↗
    2023-10-11 CVE-2023-48290 Guessable CAPTCHA Affects < 1.15.21 Patched in 1.15.21
31. High · 7.2 Form Maker by 10Web <= 1.15.18 - Unauthenticated Stored Cross-Site Scripting ↗
    2023-10-03 CVE-2023-45071 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.18 Patched in 1.15.19
32. Medium · 6.1 Form Maker by 10Web <= 1.15.18 - Reflected Cross-Site Scripting ↗
    2023-10-03 CVE-2023-45070 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.15.18 Patched in 1.15.19
33. Critical · 9.8 Form Maker by 10Web <= 1.15.19 - Unauthenticated Arbitrary File Upload ↗
    2023-09-07 CVE-2023-4666 Unrestricted Upload of File with Dangerous Type Affects < 1.15.20 Patched in 1.15.20
34. Medium · 4.3 Form Maker <= 1.15.16 - Missing Authorization in check_score ↗
    2023-06-14 Missing Authorization Affects <= 1.15.16 Patched in 1.15.17
35. High · 7.2 Form Maker <= 1.15.5 - Authenticated (Administrator+) SQL Injection ↗
    2022-09-29 CVE-2022-3300 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.15.5 Patched in 1.15.6
36. Medium · 5.5 Form Maker <= 1.14.11 - Stored Cross-Site Scripting ↗
    2022-05-09 CVE-2022-1564 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.14.11 Patched in 1.14.12
37. Medium · 5.4 Form Maker <= 1.13.59 - Authenticated Stored Cross-Site Scripting ↗
    2021-07-15 CVE-2021-24526 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.13.59 Patched in 1.13.60
38. Medium · 6.1 Form Maker by 10Web < 1.13.40 - Reflected Cross-Site Scripting ↗
    2020-07-12 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.13.40 Patched in 1.13.40
39. High · 7.2 Form Maker by 10Web <= 1.13.35 - SQL Injection ↗
    2020-05-26 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.13.35 Patched in 1.13.36
40. High · 8.8 Form Maker by 10Web <= 1.13.2 - Authenticated SQL Injection ↗
    2019-05-10 CVE-2019-10866 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.13.3 Patched in 1.13.3
41. High · 8.1 Form Maker by 10Web <= 1.13.4 - Cross-Site Request Forgery to Local File Inclusion ↗
    2019-04-05 CVE-2019-11590 Cross-Site Request Forgery (CSRF) Affects <= 1.13.4 Patched in 1.13.5
42. High · 7.8 Form Maker by 10Web <= 1.12.21 - CSV Injection ↗
    2018-04-27 CVE-2018-10504 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects < 1.12.22 Patched in 1.12.22

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 59 languages, 1 at 90% or more

Plus 35 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-04-04 40K+ → 30K+ down after 355 days in tier
2. 2025-04-14 50K+ → 40K+ down after 356 days in tier
3. 2024-04-23 60K+ → 50K+ down after 284 days in tier
4. 2023-07-14 70K+ → 60K+ down after 262 days in tier
5. 2022-10-25 80K+ → 70K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 90K+ installs · 4.8★ · 3 shared tags A
• Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder 10K+ installs · 4.9★ · 3 shared tags A
• Gutenverse Form – Contact Form Builder, Block Form & Booking Form 10K+ installs · 4.0★ · 3 shared tags B
• Survey Maker by AYS 5K+ installs · 4.7★ · 3 shared tags A
• Smart Forms – when you need more than just a contact form 5K+ installs · 4.5★ · 3 shared tags A
• Hash Form – Drag & Drop Form Builder 3K+ installs · 4.1★ · 3 shared tags B

Embed this report card

Drop a live Pulse card for Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder into a readme, a review or a deck. It updates itself.

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: 30K+ active installs, 4.5★ (777 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/form-maker