Stored Cross-Site Scripting Vulnerability in Form Maker by 10Web for WordPress
CVE-2024-10562

Currently unrated

Key Information:

Vendor
Wordpress
Status
Form Maker By 10web
Vendor
CVE Published:
7 January 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The Form Maker plugin by 10Web for WordPress, when used in versions earlier than 1.15.31, is susceptible to a stored cross-site scripting (XSS) vulnerability. This issue arises because certain plugin settings are not properly sanitized or escaped. As a result, users with high privileges, such as administrators, may inadvertently execute malicious scripts even in configurations where the 'unfiltered_html' capability is disabled, potentially exposing WordPress multisite setups to significant security risks.

Affected Version(s)

Form Maker by 10Web 0 < 1.15.31

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10562 - Proof of Concept

References

https://wpscan.com/vulnerability/317f6cb7-774f-4381-a855-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ingatyev
WPScan
.