CVE-2026-120512: Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdform<n>element<id> (Hidden Input field, name = user-defined, e.g. hiddenprobe)' parameter in all versions up to, and including, 1.15.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to open the Submissions screen and click the Show-on-Map link associated with the poisoned entry, at which point the attacker-controlled fieldid value is echoed unescaped into a single-quoted JavaScript string in the FormMakerEditCountryinPopup popup — a step whose nonce and capability checks are automatically satisfied by the administrator's own session and the freshly minted fmajaxnonce embedded in the link.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running Form Maker by 10Web versions up to and including 1.15.50 are affected. An attacker does not need to authenticate, but successful script execution depends on an administrator reviewing the poisoned submission and using its Show-on-Map link.
What does an attacker need to do to trigger the vulnerable path?
The attacker needs to submit a form containing a crafted value through a hidden-input parameter named in the wdform_<n>_element<id> pattern. They must then wait for an administrator to open the Submissions screen and click Show-on-Map for that submission.
Are WordPress nonce and capability checks a barrier to exploitation?
No. The required checks are satisfied by the administrator's authenticated session and the fm_ajax_nonce embedded in the Show-on-Map link when the administrator clicks it.
How can I determine whether a site may already be affected?
Review Form Maker submissions for unexpected or suspicious values in hidden input fields, particularly submissions that may have been opened through Show-on-Map. The vulnerable value is used as field_id data in the FormMakerEditCountryinPopup popup.