What is the CVSS score of CVE-2026-4388?

CVE-2026-4388 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-4388?

Within 24 hours: Disable Form Maker by 10Web plugin via wp-admin or command line until patched; review recent form submissions for suspicious content, particularly Matrix field entries. Within 7 days: Monitor vendor advisory channels (10Web support and plugin repository) for patch availability; test patch in staging environment before production deployment. Within 30 days: Apply vendor-released patch immediately upon availability to all Form Maker instances; implement Content Security Policy (CSP) headers to restrict inline script execution as compensating control.

Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder CVE-2026-4388

EUVD-2026-22199 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 Wordfence

GHSA-73v2-xp42-4vcq

WordPress XSS Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder Wordpress Plugin 10Web

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 02:55 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 02:45 euvd

EUVD-2026-22199

Analysis Generated

Apr 14, 2026 - 02:45 vuln.today

CVE Published

Apr 14, 2026 - 02:25 nvd

HIGH 7.2

DescriptionCVE.org

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization (sanitize_text_field strips tags but not quotes) and missing output escaping when rendering submission data in the admin Submissions view. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript through a form submission that executes in the browser of an administrator who views the submission details.

AnalysisAI

Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers to inject malicious JavaScript through Matrix field submissions that executes when administrators view submission details. The vulnerability stems from inadequate sanitization (sanitize_text_field removes tags but preserves quotes) and missing output escaping in the admin Submissions view. With CVSS 7.2 (High) and network-based attack vector requiring no privileges or user int

Technical ContextAI

The vulnerability resides in the Form Maker by 10Web plugin (CPE: cpe:2.3:a:10web:form_maker_by_10web), specifically in the Matrix field component with Text Box input type. The flaw is a classic Stored XSS (CWE-79) caused by a sanitization bypass. The plugin applies WordPress's sanitize_text_field() function to user input, which strips HTML tags but intentionally preserves quote characters to maintain data integrity for legitimate uses. However, when this partially sanitized data is rendered in admin/views/FormMakerSubmits.php (lines 166-169 in version 1.15.37) without proper output escaping (such as esc_html() or esc_attr()), preserved quotes enable attackers to break out of HTML attribute context and inject JavaScript. The vulnerable code path: frontend/models/form_maker.php processes form submissions (line 2352), applies insufficient sanitization, stores the payload in the database, then renders it unsafely in the administrative interface. This two-stage attack (store-then-execute) is characteristic of Stored XSS and more dangerous than Reflected XSS because the payload persists and affects multiple victims over time.

RemediationAI

Upgrade immediately to Form Maker by 10Web plugin version 1.15.41 or later, which addresses the sanitization and output escaping deficiencies based on the patch committed to the WordPress plugin repository (changeset 3501693 visible at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3501693%40form-maker%2Ftrunk&old=3492680%40form-maker%2Ftrunk). Site administrators should update through the WordPress admin dashboard (Dashboard → Updates → Plugins) or via WP-CLI command 'wp plugin update form-maker'. After patching, review all existing form submissions for suspicious content, particularly in Matrix field entries, as previously stored XSS payloads will persist in the database until manually sanitized. If immediate patching is not feasible, consider temporary workarounds: restrict access to form submission review pages to only highly trusted administrators using role-based access control plugins, implement Web Application Firewall (WAF) rules to filter quote characters and JavaScript keywords from form submissions (though this may break legitimate use cases), or temporarily disable the Form Maker plugin if forms are non-critical. For comprehensive details and code-level changes, consult the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/197449f5-9304-49df-9261-a354145fc00e and review the source code diff in the WordPress plugin repository.