CVE-2026-96813: Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using Form Maker by 10Web version 1.15.47 or earlier are affected, specifically where Mark on Map longitude or latitude field content can be injected and later viewed.
Does an attacker need an account or user interaction to exploit it?
No. The vulnerability can be exploited by an unauthenticated attacker and does not require victim interaction for injection. The stored script executes when a user later accesses the injected page.
What is the impact if exploitation succeeds?
An attacker can store arbitrary web script in an affected page. That script runs in the browser of users who access the page, with low confidentiality and integrity impact indicated by the supplied vector.