Stored Cross-Site Scripting in Form Maker Plugin by 10Web
CVE-2024-13053
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 15 May 2025
Badges
What is CVE-2024-13053?
The Form Maker plugin by 10Web for WordPress prior to version 1.15.33 is vulnerable to stored cross-site scripting (XSS) attacks. This security flaw arises from the failure to properly sanitize and escape certain settings. Consequently, even high-privilege users like admins of multisite installations can perform XSS attacks, potentially leading to the execution of malicious scripts. It emphasizes the need for regular updates and rigorous security reviews to mitigate such vulnerabilities and protect user data.
Affected Version(s)
Form Maker by 10Web 0 < 1.15.33
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved