EUVD-2026-75254
GHSA-w4x6-r3gr-44xf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no attacker auth (PR:N); victim must click crafted link (UI:R); scope change applies as payload executes in the privileged WordPress admin browser context (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to inject arbitrary JavaScript into WordPress admin pages via the unsanitized bulk_action parameter in the Submissions controller. Successful exploitation requires social-engineering an authenticated WordPress admin into clicking a crafted link, enabling session hijacking or unauthorized admin actions in the victim's browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The plugin must be installed and active on the target WordPress site (any version ≤1.15.46). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 score is appropriate and reflects genuine constraints: UI:R means the attacker cannot exploit this without social engineering, and the realistic target is an authenticated WordPress user with access to the plugin's Submissions admin page - typically an administrator or editor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Form Maker by 10Web plugin to version 1.15.47 or later; the fix is confirmed by WordPress SVN changesets at https://plugins.trac.wordpress.org/changeset?reponame=&new=3686568%40form-maker%2Ftags%2F1.15.47&old=3652521%40form-maker%2Ftags%2F1.15.46 and https://plugins.trac.wordpress.org/changeset/3686567/form-maker/trunk/admin/controllers/Submissions_fm.php. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated SQL injection in Form Maker by 10Web plugin allows remote attackers to extract sensitive database conten
Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subsc
SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level at
SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticat
SQL injection in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows authenticated administrators to extract
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today