What is the CVSS score of CVE-2026-1065?

CVE-2026-1065 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1065?

The Form Maker by 10Web WordPress plugin contains a critical vulnerability allowing unauthenticated attackers to inject malicious code through SVG file uploads, which executes when administrators or…

How to fix or mitigate CVE-2026-1065?

Within 24 hours: Disable the Form Maker plugin or restrict file upload functionality if business-critical, and audit recent form submissions for suspicious SVG files. Within 7 days: Implement WAF rules to block SVG uploads to form handlers and conduct a security review of affected forms and user accounts. Within 30 days: Monitor vendor for patch availability and establish a process to apply updates immediately upon release; evaluate alternative form solutions without this vulnerability.

WordPress CVE-2026-1065

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-02-03 security@wordfence.com

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 07:16 nvd

HIGH 7.2

DescriptionCVE.org

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.

AnalysisAI

Unauthenticated attackers can upload malicious SVG files through the Form Maker by 10Web WordPress plugin (versions up to 1.15.35) due to insufficient file type validation, enabling stored cross-site scripting attacks against administrators and site visitors. The plugin's default allowlist includes SVG files and relies on weak substring-based extension checking, allowing JavaScript execution when the uploaded files are viewed. No patch is currently available.

Technical ContextAI

This vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affects Form Maker by 10Web (WordPress plugin). The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can subm

Affected ProductsAI

Vendor: WordPress. Product: Form Maker by 10Web (WordPress plugin).

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.