Stored Cross-Site Scripting in 10Web's Form Maker Plugin for WordPress

CVE-2026-118067

What is CVE-2026-118067?

The Form Maker plugin by 10Web presents a Stored Cross-Site Scripting vulnerability, permitting unauthenticated attackers to introduce malicious web scripts into WordPress pages. This occurs through the 'wdform_<field_id>_element<form_id> (payload) + disabled_fields<form_id> (pivot)' parameter due to inadequate input sanitization and escaping processes. Successful exploitation requires a targeted form to contain a File Upload field, allowing the attacker to manipulate the data submitted. Once a user accesses an affected page, the malicious scripts execute, posing risks to user data and site integrity. Administrators are particularly vulnerable when reviewing submission data.

References