Unauthenticated XSS in Form Maker by 10Web

Executive Summary

This is an Unauthenticated Cross Site Scripting (XSS) vulnerability found in the Form Maker by 10Web plugin versions up to and including 1.15.46. XSS allows attackers to inject malicious scripts into web pages viewed by other users without needing authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability in Form Maker by 10Web <= 1.15.46, inspect web forms for unsanitized user input fields. Check for reflected or stored XSS by submitting test payloads like <script>alert(1)</script> in form inputs and observe if the script executes. Review server responses for unescaped HTML output.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal user sessions, redirect users to malicious sites, or deface web pages. Since no authentication is required, the risk is higher as any user visiting a vulnerable site could be affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive data. Under GDPR, this may result in fines for insufficient technical safeguards. For HIPAA, it could violate security requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Form Maker by 10Web to the latest version beyond 1.15.46. If an update is unavailable, disable the plugin temporarily. Implement input validation and output encoding for all form fields. Use a web application firewall to filter malicious scripts.

Useful 0 Not Useful 0