Description

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdform_<n>_element<id> (Hidden Input field, name = user-defined, e.g. hidden_probe)' parameter in all versions up to, and including, 1.15.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to open the Submissions screen and click the Show-on-Map link associated with the poisoned entry, at which point the attacker-controlled field_id value is echoed unescaped into a single-quoted JavaScript string in the FormMakerEditCountryinPopup popup — a step whose nonce and capability checks are automatically satisfied by the administrator's own session and the freshly minted fm_ajax_nonce embedded in the link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-07T03:17:03.210Z",
  "pubdate": "2026-11-07T03:17:03.210Z",
  "executiveSummary": "The Form Maker by 10Web plugin, in versions up to and including 1.15.50, contains a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from improper sanitization and output escaping of user-supplied data in hidden input fields.\nUnauthenticated attackers can inject arbitrary malicious JavaScript payloads via the 'wdform_<n>_element<id>' parameters. These payloads remain dormant within the application database until triggered.\nThe vulnerability is exploited when an administrator views a form submission and invokes the 'Show-on-Map' functionality. At this point, the stored malicious script is rendered within the FormMakerEditCountryinPopup context, executing in the administrator's browser session.\nSuccessful exploitation allows an attacker to execute arbitrary code within the security context of the administrator's session, potentially leading to unauthorized administrative actions, session hijacking, or data exfiltration. Given that the attack requires administrator interaction, the primary risk involves the compromise of high-privileged accounts through automated or social-engineered submission review processes.",
  "technicalDetails": "The vulnerability is fundamentally a Stored Cross-Site Scripting (XSS) flaw located in the data processing and display logic of the Form Maker by 10Web plugin. The root cause is insufficient input sanitization of the 'wdform_<n>_element<id>' parameter—specifically targeting hidden input fields defined by the user—combined with the failure to perform context-aware output escaping when displaying submission data.\nAttackers can submit arbitrary JavaScript payloads through these hidden form fields without requiring prior authentication. Because the plugin does not validate the content of these parameters, the malicious payload is stored persistently within the WordPress database associated with the specific form submission entry.\nThe exploitation flow is triggered on the administrative side. When an administrator accesses the Submissions screen and clicks the 'Show-on-Map' link associated with a poisoned entry, the application retrieves the stored data from the database. This data, including the attacker-supplied payload, is then echoed directly into a single-quoted JavaScript string within the 'FormMakerEditCountryinPopup' component.\nBecause the payload is injected into a JavaScript string context without proper escaping or neutralization of characters such as single quotes, an attacker can break out of the string literal to execute arbitrary JavaScript commands. The security mechanism—specifically the 'fm_ajax_nonce'—is automatically bypassed because the link containing the nonce is generated dynamically for the administrator, providing the necessary authorization tokens to execute the request within their active, privileged session.\nConsequently, the malicious script executes with the privileges of the administrator, facilitating cross-site request forgery, theft of administrative session cookies, or the modification of site configurations. The vulnerability persists across all versions up to 1.15.50, necessitating an update to a version where input sanitization and output escaping are correctly implemented."
}