Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values
- ID
- WPSEC-2026-2220
- Plugin
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder (form-maker)
- Affected
- all versions before 1.15.51
- Remediation
- Update to 1.15.51 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Form Maker by 10Web on WPSec AttackSurface
- Fix released
- Published
Description
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission values in all versions up to, and including, 1.15.50, due to insufficient output escaping in the admin submissions table. The table decides whether to HTML-escape each stored value by its loop index instead of by the value's own field type. A submitter can use the 'disabled_fields' parameter to leave out fields, which shifts the indexes so that a text value lines up with the form's file upload field and is not escaped. Such a value, when it contains a star rating marker, is then placed into <img> id and src attributes without escaping. This makes it possible for unauthenticated attackers who submit a form that contains a file upload field to inject arbitrary web scripts that execute when an administrator views the form's submissions.
References
- https://wpsec.com/vuln/WPSEC-2026-2220/
- https://plugins.svn.wordpress.org/form-maker/tags/1.15.51/
- https://wordpress.org/plugins/form-maker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS