CVE-2026-66616: WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is described as unauthenticated, so an attacker does not need a WordPress account or existing plugin privileges to attempt exploitation. Exploitation still requires user interaction, as indicated by the UI:R metric.
Which installations are affected?
WordPress sites using Form Maker by 10Web version 1.15.46 or earlier are affected according to the available information.
What impact could successful exploitation have?
The severity vector indicates low confidentiality, integrity, and availability impact, with scope changed. As an XSS issue, successful exploitation can execute attacker-controlled script in a victim's browser context.