Stored Cross-Site Scripting in Form Maker by 10Web WordPress Plugin

CVE-2026-96813

What is CVE-2026-96813?

The Form Maker plugin by 10Web for WordPress contains a security flaw that allows attackers to exploit stored Cross-Site Scripting (XSS) vulnerabilities through the 'Mark on Map' Longitude/Latitude fields. This vulnerability stems from inadequate input sanitization and output escaping, enabling unauthenticated users to inject arbitrary scripts into pages. When other users access these compromised pages, the injected scripts are executed in their browsers, potentially leading to data theft or session hijacking. All versions of the plugin up to and including 1.15.47 are affected, highlighting the critical need for users to upgrade to the latest version to safeguard against such attacks.

References