CVE-2026-85645

Deferred Deferred - Pending Action

Reflected Cross-Site Scripting in Form Maker by 10Web WordPress Plugin

Publication date: 2026-09-10

Last updated on: 2026-09-11

Assigner: Wordfence

Description

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-11

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-85645

EUVD

EUVD-2026-75254

Affected Vendors & Products

Vendor	Product	Version / Range
10web	form_maker	to 1.15.46 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the Form Maker by 10Web WordPress plugin. It affects versions up to 1.15.46 due to insufficient input sanitization and output escaping in the bulk_action parameter. An unauthenticated attacker can inject malicious scripts into web pages, which execute when a user clicks a crafted link.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the Form Maker plugin versions up to 1.15.46 for reflected XSS via the bulk_action parameter. Check server logs for suspicious input in URLs or form submissions. Use tools like WPScan to scan for vulnerable plugin versions.

Impact Analysis

This vulnerability allows attackers to execute arbitrary web scripts in your browser when you interact with a malicious link. This could lead to theft of cookies, session tokens, or other sensitive data, or allow the attacker to perform actions on your behalf while you are logged into the site.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling attackers to inject malicious scripts into web pages. If exploited, it may lead to unauthorized data access or manipulation, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately update the Form Maker plugin to the latest version. If an update is unavailable, disable the plugin until a patch is released. Implement web application firewalls to filter malicious input. Monitor for unusual activity in server logs.

Hi! I’m here to help you understand CVE-2026-85645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70