Description

Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:35.197Z",
  "pubdate": "2026-08-20T12:16:35.197Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Form Maker by 10Web plugin, affecting all versions up to and including 1.15.46. This security flaw enables remote attackers to inject arbitrary malicious client-side scripts, typically written in JavaScript, into web pages rendered to legitimate users visiting the site.\nThe primary impact of this vulnerability includes session hijacking, unauthorized execution of actions within the context of the victim's browser session, theft of sensitive authentication tokens, and potential redirection to malicious phishing infrastructure. Because the vulnerability is unauthenticated, exploitation requires no prior access or credentials to the target WordPress installation, lowering the attack barrier significantly.\nThe risk implication is critical for sites utilizing the affected versions of Form Maker, as successful exploitation compromises the integrity and confidentiality of user interactions with the vulnerable web application. Remediation requires updating the Form Maker by 10Web plugin to a patched version beyond 1.15.46 as soon as it becomes available.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the Form Maker by 10Web plugin, specifically within versions 1.15.46 and prior. The root cause stems from the lack of proper input sanitization and context-aware output encoding on user-supplied parameters before they are reflected back to the client within the Hypertext Markup Language (HTML) response.\nThe affected component fails to validate or neutralize malicious input vectors passed via HTTP requests. Due to the unauthenticated and network-exposed nature of the attack surface, an external threat actor can craft a malicious Uniform Resource Locator (URL) or malicious HTTP request containing malicious payload vectors, such as script tags or event handlers.\nThe attack flow proceeds as follows: First, the attacker formulates a payload containing executable JavaScript designed to execute within the Document Object Model (DOM) of a victim's browser. Second, the attacker transmits this payload via unauthenticated HTTP requests to the vulnerable endpoints associated with Form Maker by 10Web. Third, the application processes the request and improperly embeds the unescaped input directly into the HTTP response. Fourth, when a victim accesses the crafted URL or interacts with the vulnerable form component, the victim's browser parses and executes the injected script.\nThe payload executes with the privileges of the victim's active session, allowing the script to access Document properties, manipulate the DOM, read cookies, or perform asynchronous requests on behalf of the user. Post-exploitation impact varies depending on the privileges of the targeted user; if an administrative user falls victim to the payload, the attacker can leverage the session to create new administrator accounts, install malicious plugins, or compromise the underlying server infrastructure."
}