CVE-2026-103998: Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to, and including, 1.15.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can attempt exploitation remotely; no WordPress account or other privileges are required. Successful exploitation depends on convincing a user to take an action such as clicking an attacker-controlled link.
What is the likely impact if exploitation succeeds?
Injected script can execute in the context of the affected page viewed by the targeted user. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.
Which installations are affected?
Form Maker by 10Web versions up to and including 1.15.48 are affected. The provided data does not identify a fixed version or a configuration-based workaround.