CVE-2026-4388
Stored XSS in Form Maker by 10Web Plugin Allows Admin Hijack
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 10web | form_maker | to 1.15.40 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Form Maker by 10Web plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its Matrix field (Text Box input type) within form submissions. This vulnerability exists in all versions up to and including 1.15.40. It arises because the plugin does not properly sanitize input—specifically, the sanitize_text_field function removes HTML tags but not quotes—and it fails to escape output when displaying submission data in the admin Submissions view. As a result, an unauthenticated attacker can inject arbitrary JavaScript code through a form submission, which will execute in the browser of an administrator who views the submission details.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to inject and execute arbitrary JavaScript code in the browser of an administrator viewing form submissions. This can lead to several impacts including theft of administrator session cookies, unauthorized actions performed with administrator privileges, defacement of the admin interface, or further compromise of the WordPress site.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists in all versions of the Form Maker by 10Web plugin for WordPress up to and including 1.15.40. To mitigate this vulnerability, you should update the plugin to a version later than 1.15.40 where the issue is fixed.
Additionally, as a temporary measure, restrict access to the WordPress admin Submissions view to trusted users only, since the vulnerability allows unauthenticated attackers to inject JavaScript that executes in the browser of administrators viewing submissions.