Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder CVE-2026-4388

Form Maker by 10Web plugin version 1.15.40 or earlier must be installed and activated with at least one form containing a Matrix field (Text Box input type) accessible for public submission. No authentication required for initial attack; admin access only needed for payload execution.

Real-world risk is HIGH despite some mitigating factors. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates network-accessible exploitation with low complexity, no authentication required, no user interaction needed for initial submission, and changed scope affecting resources beyond the vulnerable component. The PR:N (no privileges required) means any internet user can submit malicious forms, and UI:N indicates the payload executes automatically when an admin views submissions without requiring victim interaction beyond normal workflow. The 7.2 score reflects Confidentiality and Integrity impacts rated Low, which is accurate since XSS in admin context can steal session tokens, create rogue admin accounts, or modify site content, but typically doesn't directly cause availability impact. However, CVSS may underestimate real risk: administrators routinely review form submissions as part of normal operations, guaranteeing payload execution. The Changed Scope (S:C) correctly recognizes that compromising an admin session affects the entire WordPress installation beyond just the plugin. Without EPSS data, we cannot quantify exploitation probability, but WordPress plugins with millions of installations are attractive targets. No CISA KEV listing suggests no confirmed mass exploitation campaigns yet, but the attack vector is straightforward for threat actors familiar with WordPress security. The combination of unauthenticated submission, automatic execution in privileged context, and widespread plugin deployment makes this a realistic priority for organizations using Form Maker by 10Web, not merely a theoretical high-CVSS issue.

An unauthenticated attacker identifies a WordPress site running Form Maker by 10Web plugin version 1.15.40 or earlier, likely through plugin enumeration techniques or WordPress version detection tools. The attacker locates a publicly accessible form utilizing the Matrix field component with Text Box input type, such as a contact form, survey, or registration form. They craft a malicious form submission inserting a JavaScript payload