7.5
High
CVE-2026-105413 Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values
Description
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Form Maker by 10Web 1.15 | earliest → < 1.15.51 | 1.15.51 |
Other CVEs of Form Maker by 10Web
The 11 CVEs of Form Maker by 10Web →
CVE-2026-16977
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that…
8.1
High
CVE-2025-15441
The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL…
6.8
Medium
CVE-2024-13053
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which…
4.8
Medium
CVE-2024-10680
The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which…
4.8
Medium