CVE-2026-118067: Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdform<fieldid>element<formid> (payload) + disabledfields<formid> (pivot)' parameter in all versions up to, and including, 1.15.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the targeted form to contain a File Upload field, as the attacker must suppress that field's storage row via the disabledfields parameter to shift a controlled text-field value into the positional slot where escaping is skipped; execution occurs when an administrator opens the Submissions page for the affected form.
Event History
Frequently Asked Questions
Which sites are actually exposed to exploitation?
A site is exposed if it runs Form Maker by 10Web version 1.15.50 or earlier and has a targeted form containing a File Upload field. The vulnerable submission must then be viewed by an administrator on that form’s Submissions page for the injected script to execute.
Does an attacker need an account or administrator access?
No. The issue is exploitable by an unauthenticated attacker, provided they can submit data to a qualifying form and use the disabled_fields parameter to suppress the File Upload field’s storage row.
What makes the File Upload field important to this attack?
The attacker uses disabled_fields to omit the File Upload field’s stored row, shifting an attacker-controlled text-field value into a positional output slot where escaping is skipped. Forms without a File Upload field do not meet the stated prerequisite for this exploit path.
How can administrators determine whether a malicious submission may affect them?
Review submissions for forms that include a File Upload field, especially submissions containing unexpected script-like content in text fields. The payload executes when an administrator opens the affected form’s Submissions page, so exercise caution when reviewing suspicious submissions.