CVE-2024-10265: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10265?
CVE-2024-10265 is rated as a moderate severity vulnerability due to the potential for reflected cross-site scripting.
How do I fix CVE-2024-10265?
To fix CVE-2024-10265, update the Form Maker plugin to version 1.15.31 or later.
What versions are affected by CVE-2024-10265?
CVE-2024-10265 affects all versions of the Form Maker plugin up to and including 1.15.30.
What kind of attack does CVE-2024-10265 enable?
CVE-2024-10265 enables attackers to perform reflected cross-site scripting attacks.
Is CVE-2024-10265 specific to WordPress?
Yes, CVE-2024-10265 specifically affects the Form Maker plugin for WordPress.