Form Maker by 10Web EUVD-2026-75254

The plugin must be installed and active on the target WordPress site (any version ≤1.15.46). The attacker requires no credentials of their own (PR:N per CVSS). The victim must be an authenticated WordPress user with access to the plugin's Submissions admin page - typically a site administrator or editor - and must click or follow a crafted URL containing the malicious bulk_action payload (UI:R). No special plugin configuration is required beyond active installation. Limiting factors: the social-engineering requirement (UI:R) prevents automated mass exploitation; the target audience is narrowed to users with admin-area access, not arbitrary site visitors.

The CVSS 6.1 score is appropriate and reflects genuine constraints: UI:R means the attacker cannot exploit this without social engineering, and the realistic target is an authenticated WordPress user with access to the plugin's Submissions admin page - typically an administrator or editor. The C:L/I:L ratings correctly bound the impact to limited cookie theft or session-scoped admin actions rather than full server compromise. No public exploit code, CISA KEV listing, or EPSS score is available from the provided intelligence, suggesting no observed widespread exploitation. Real-world risk is moderate for sites running the plugin actively: form management plugins are commonly deployed and the admin Submissions page is a plausible phishing target in spear-phishing campaigns against site owners. The attack requires no attacker authentication (PR:N confirmed by CVSS), but delivery friction (UI:R) substantially limits opportunistic exploitation.

An attacker identifies a WordPress site running Form Maker by 10Web ≤1.15.46 and crafts a URL targeting the plugin's Submissions admin page with a JavaScript payload embedded in the bulk_action parameter. The attacker delivers this URL to a site administrator via phishing email; when the admin clicks the link while authenticated, the script executes in their browser, exfiltrating session cookies or silently creating a new admin account. No public proof-of-concept code was identified at time of analysis.