CVE-2026-105413: Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Form Maker by 10Web versions before 1.15.51 are exposed if an administrator views submissions containing attacker-controlled field values. An attacker does not need to authenticate to submit a malicious payload.
What must happen for the payload to execute?
The attacker must submit a crafted field value through a form, and an administrator must later open the plugin's submissions administration page where that value is rendered. The payload executes in the administrator's browser session.
How can I determine whether my site may already be affected?
Check whether the installed Form Maker by 10Web version is earlier than 1.15.51, and review stored form submissions for unexpected script-like or HTML content in field values. Treat suspicious submissions as potentially malicious if they may have been viewed in the submissions admin page.