Form Maker EUVD-2026-96065

Exploitation requires the attacker to deliver a crafted link (containing the payload in the 'inputs' array-key parameter) to a victim who must actively click it while a vulnerable Form Maker form page is reachable - this user-interaction requirement (UI:R) is the primary limiting factor. No authentication or special privileges are needed on the attacker side (PR:N), and default configurations of the Form Maker by 10Web plugin on versions up to and including 1.15.48 are affected as long as a plugin-rendered form is present on an accessible page. Impact severity rises if the clicking victim is an authenticated administrator, since the injected script runs in their session context.

This is a moderate-severity reflected XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) that should be treated as routine patch-management rather than an emergency. The signals are internally consistent: the network vector (AV:N) and no-privilege requirement (PR:N) mean unauthenticated attackers can craft the payload, but the required user interaction (UI:R) is the dominant limiting factor - a victim must be tricked into clicking an attacker-supplied link, which caps real-world exploitability. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vulnerability is NOT in CISA KEV and no public exploit code was referenced, so there is no evidence of active exploitation. The scope change (S:C) and low C/I impact reflect that code executes in the victim's browser context rather than compromising the server directly. Net assessment: a real but low-priority issue typical of reflected XSS in WordPress plugins - patch on a normal cycle, not as a fire drill. The one caveat is that reflected XSS against a WordPress admin session could escalate (e.g., to admin account/content manipulation), so prioritize higher if the plugin runs on high-value sites.

An unauthenticated attacker crafts a malicious URL targeting a vulnerable Form Maker form, embedding a script payload in the 'inputs' array-key parameter, and distributes it via phishing email or a malicious link. When a logged-in site user or administrator clicks the link, the unsanitized parameter is reflected into the page and the script executes in their browser, enabling session/cookie theft or actions in their authenticated context. No public exploit code was identified in the provided data, but reflected XSS of this form is trivial to weaponize manually.