Executive Summary

The Form Maker by 10Web plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its Matrix field (Text Box input type) within form submissions. This vulnerability exists in all versions up to and including 1.15.40. It arises because the plugin does not properly sanitize input—specifically, the sanitize_text_field function removes HTML tags but not quotes—and it fails to escape output when displaying submission data in the admin Submissions view. As a result, an unauthenticated attacker can inject arbitrary JavaScript code through a form submission, which will execute in the browser of an administrator who views the submission details.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to inject and execute arbitrary JavaScript code in the browser of an administrator viewing form submissions. This can lead to several impacts including theft of administrator session cookies, unauthorized actions performed with administrator privileges, defacement of the admin interface, or further compromise of the WordPress site.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability exists in all versions of the Form Maker by 10Web plugin for WordPress up to and including 1.15.40. To mitigate this vulnerability, you should update the plugin to a version later than 1.15.40 where the issue is fixed.

Additionally, as a temporary measure, restrict access to the WordPress admin Submissions view to trusted users only, since the vulnerability allows unauthenticated attackers to inject JavaScript that executes in the browser of administrators viewing submissions.

Useful 0 Not Useful 0