Form Maker by 10Web CVE-2026-66616

The vulnerability is exploitable by unauthenticated remote attackers (PR:N, AV:N) against any WordPress installation running Form Maker by 10Web version 1.15.46 or earlier where at least one form is publicly accessible. Exploitation requires victim interaction (UI:R): a logged-in or browsing user must load a page or follow a link containing the injected payload. The scope change (S:C) confirms the injected script executes beyond the vulnerable component's own context. No special server-side configuration beyond having the plugin installed and active is required. Exploitation is limited by the user-interaction requirement - purely automated mass exploitation without social engineering is not viable given UI:R.

The CVSS 7.1 score reflects real but bounded risk: network-reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R) - a victim must load a crafted URL or page. The scope change (S:C) elevates severity by acknowledging cross-context JavaScript execution. EPSS data is not provided in the source intelligence, which limits probabilistic exploitation forecasting. There is no CISA KEV listing and no confirmed POC, so exploitation is currently theoretical from a public-record standpoint, though Patchstack's disclosure increases discovery likelihood. The plugin's broad deployment across WordPress sites means attack surface is wide; even a small regional IT team managing a WordPress-based public portal should treat this as a meaningful priority for patching. SSVC signals suggest 'Track/Attend' posture: publicly documented, no confirmed active exploitation, patch availability status not confirmed from available data. The combination of PR:N and S:C makes this a higher-value target for phishing or watering-hole campaigns than the raw numeric score may suggest.

An attacker crafts a malicious URL containing a JavaScript payload injected into a vulnerable form parameter served by the plugin, then delivers it to a target - such as an administrator or authenticated WordPress user - via phishing or a watering-hole link. When the victim loads the URL, the unsanitized input is rendered in their browser, executing the attacker's script within the site's origin context. This could be used to steal session cookies, capture credentials, or perform administrative actions on the victim's behalf. No public exploit code has been identified at time of analysis.