# Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values

- **ID:** WPSEC-2026-2220
- **Plugin:** Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder (`form-maker`), https://wordpress.org/plugins/form-maker/
- **Affected versions:** all versions before 1.15.51
- **Fixed in:** 1.15.51 (Update to 1.15.51 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/form-maker
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2220/

## Description

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission values in all versions up to, and including, 1.15.50, due to insufficient output escaping in the admin submissions table. The table decides whether to HTML-escape each stored value by its loop index instead of by the value's own field type. A submitter can use the 'disabled_fields' parameter to leave out fields, which shifts the indexes so that a text value lines up with the form's file upload field and is not escaped. Such a value, when it contains a star rating marker, is then placed into <img> id and src attributes without escaping. This makes it possible for unauthenticated attackers who submit a form that contains a file upload field to inject arbitrary web scripts that execute when an administrator views the form's submissions.

## References

- https://wpsec.com/vuln/WPSEC-2026-2220/
- https://plugins.svn.wordpress.org/form-maker/tags/1.15.51/
- https://wordpress.org/plugins/form-maker/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2220/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.