EUVD-2026-90571
GHSA-6hr3-5gmx-jj2q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate public form with Map field
-
DeliverySubmit entry with script in Lat/Long values
-
ExploitPayload stored unsanitized
-
ExecutionAdmin/user views injected page
-
PersistScript executes in victim browser
-
ImpactHijack session or forge actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a published 10Web Form Maker form (version ≤1.15.47) that includes a 'Mark on Map' field exposing Longitude/Latitude inputs; the attacker submits crafted values that are stored without sanitization and escaped insufficiently on output. Exploitation is unauthenticated (PR:N) over the network, but payload execution depends on a victim subsequently rendering the injected content - the code references (Submissions_fm.php#L626, FMMapEditinPopup.php) indicate the stored script commonly fires when an administrator reviews form submissions, which is the practical limiting factor. Sites not using the Map field type, or already on 1.15.48+, are not exposed. |
| Impact | This is a stored (persistent) XSS in the popular 10Web Form Maker WordPress plugin, scored CVSS 3.1 7.2 (High) by Wordfence. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates network-reachable, low-complexity, unauthenticated (PR:N) exploitation with a scope change (S:C) because injected script executes in the browsers of other users - the elevated 7.2, unusual for XSS, is driven entirely by PR:N plus S:C. No EPSS score, CISA KEV entry, SSVC decision data, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Confidentiality and integrity impacts are both Low (C:L/I:L) and availability is None, consistent with script-execution-in-browser rather than server compromise. Net: a genuinely exploitable unauthenticated stored-XSS worth patching on a widely-used plugin, but the real-world impact ceiling is session/DOM-level script execution (cookie/credential theft, admin-action forgery), not server takeover - treat as a moderate, patch-promptly priority rather than an emergency. Trigger realistically depends on a legitimate user (typically an admin reviewing the submission) rendering the injected content; verify whether victim rendering is truly interaction-free as UI:N implies. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a public Form Maker form containing a 'Mark on Map' field and submits a form entry with a JavaScript payload embedded in the Longitude/Latitude values, which are stored without sanitization. When a victim - most plausibly a site administrator viewing the submissions page (Submissions_fm.php) or any user rendering the injected page - loads that content, the script executes in their authenticated browser session. No public proof-of-concept was provided in the intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Stored cross-site scripting in the 10Web Form Maker WordPress plugin through version 1.15.47 lets unauthenticated attackers plant arbitrary JavaScript in a site by submitting crafted Longitude/Latitude values into a 'Mark on Map' form field. The injected script is stored and later rendered without adequate escaping, most practically firing when an administrator opens the submission or map-edit views referenced in the source (Submissions_fm.php, FMMapEditinPopup.php). Wordfence rates it CVSS 3.1 7.2 (High) with a PR:N vector, so no account is needed to inject on a site that publishes a form containing the map field; no public exploit code or confirmed active exploitation has been identified at time of analysis.
RemediationAI
Upgrade the plugin to version 1.15.48 or later - the vendor changelog at https://plugins.trac.wordpress.org/changeset?reponame=&new=3716589%40form-maker%2Ftags%2F1.15.48&old=3686568%40form-maker%2Ftags%2F1.15.47 documents the fix, and the targeted change to admin/views/FMMapEditinPopup.php (https://plugins.trac.wordpress.org/changeset/3716587/form-maker/trunk/admin/views/FMMapEditinPopup.php) indicates output escaping was added in the map popup view. If immediate patching is not possible, disable or remove any 'Mark on Map' field (and its Longitude/Latitude inputs) from published forms so the injection point no longer exists - this breaks legitimate map-based forms but eliminates the vulnerable code path. As a complementary control, restrict administrator access to the form submissions and map-edit screens to trusted users only and consider a WordPress WAF/virtual-patching rule that blocks script markup in Longitude/Latitude POST parameters; a WAF's protection is bypassable and should not substitute for the upgrade. Because the stored payload only executes on rendering, reviewing and purging existing form submissions for suspicious coordinate values after patching is also advisable to remove any already-persisted scripts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (improper neutralization of input during web page generation) in the 10Web Form Maker plugin, a drag-and-drop contact-form builder for WordPress. The plugin's 'Mark on Map' field type accepts Longitude and Latitude coordinates, which are passed through the map-editing popup and form-submission handling code paths (admin/views/FMMapEditinPopup.php, admin/controllers/FormMakerMapEditinPopup.php, admin/views/Submissions_fm.php#L626, frontend/models/form_maker.php#L1651) and through the shared library helper framework/WDW_FM_Library.php#L366. Because sanitization on input and escaping on output are both insufficient in these paths, attacker-supplied coordinate strings are persisted in form-submission data and emitted back into HTML. The CVSS scope change (S:C) reflects that the injected script executes in the context of the WordPress administrative interface, giving it reach beyond the original vulnerable component. The CPE string confirms the affected package is the 10Web 'form_maker' plugin, and the referenced Trac files at tags 1.15.47 and 1.15.44 show the vulnerable code was present across multiple releases.
Know when Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network submission (PR:N/AV:N/AC:L) stores script that runs in other users' browsers (S:C, C:L/I:L); no availability impact and no server-side compromise.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Executive ViewAI
Any WordPress site running the 10Web Form Maker plugin at version 1.15.47 or earlier is exposed to stored cross-site scripting through the 'Mark on Map' form field, and because the injection requires no account, the barrier to abuse is effectively zero for any site that publishes such a form. Malicious JavaScript submitted by an anonymous visitor is stored and later executes in the browser of an authenticated administrator, putting privileged sessions, credentials, and ultimately the integrity of the WordPress installation at risk. Leadership should treat this as a site-wide compromise vector for marketing, e-commerce, and any public-facing property relying on this plugin, particularly since no vendor fix is currently available.
No vendor-released patch identified at time of analysis. Until a fix is available: remove or disable the 'Mark on Map' Longitude/Latitude field from all published forms, deactivate the plugin if map submission is not business-critical, enforce virtual patching/WAF rules that reject non-numeric or script content in the map coordinate parameters, restrict access to submission and map-edit administrative views by IP or network, audit and purge existing stored submissions for injected script, and require phishing-resistant MFA plus least-privilege roles for all WordPress administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthentic
Unauthenticated SQL injection in Form Maker by 10Web plugin allows remote attackers to extract sensitive database conten
Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers
Reflected cross-site scripting (XSS) in the Form Maker by 10Web WordPress plugin (versions up to and including 1.15.48)
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to in
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subsc
SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level at
SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticat
SQL injection in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows authenticated administrators to extract
Exploit-DB