Stored Cross-Site Scripting Vulnerability in Form Maker Plugin by 10Web

CVE-2026-4388

What is CVE-2026-4388?

The Form Maker plugin by 10Web is prone to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization in the Matrix field. This flaw allows an attacker to inject malicious JavaScript code through form submissions, which can then be executed in the browser of an administrator who accesses the submission details. The vulnerability is present in all versions through 1.15.40, primarily resulting from the failure to effectively sanitize user inputs and escape outputs when displaying submission data in the admin interface.

References