Form Maker by 10Web: Stored Cross-Site Scripting (CVE-2026-120512)

The Form Maker by 10Web WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in hidden input fields (parameters formatted as wdform_<n>_element<id>). An unauthenticated attacker can submit malicious payloads through contact forms. The script executes in the context of an administrator's session when they view the submissions screen and select the "Show-on-Map" feature for a malicious entry. This process bypasses nonces and capability checks by utilizing the administrator's own active session and the fm_ajax_nonce provided by the application.

Attack Chain

1. Attacker identifies a target WordPress site running a vulnerable version of the Form Maker plugin.
2. Attacker crafts a malicious form submission containing XSS payloads within hidden input fields.
3. Attacker submits the form to the target application.
4. The plugin stores the payload in the database without proper sanitization.
5. An administrator navigates to the 'Submissions' screen within the WordPress dashboard.
6. The administrator interacts with the 'Show-on-Map' link associated with the malicious submission.
7. The application echoes the payload unescaped into a JavaScript string within the FormMakerEditCountryinPopup popup.
8. The malicious script executes in the administrator's browser, potentially allowing account takeover or further administrative actions.

Impact

Successful exploitation results in arbitrary script execution in an administrator's browser context, potentially leading to unauthorized administrative actions, sensitive data access, or account takeover.

Recommendation

• Update the "Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder" plugin to the latest available version (beyond 1.15.50) to ensure the sanitization fix is applied.
• Implement or enforce Content Security Policy (CSP) headers to mitigate the impact of XSS vulnerabilities.
• Monitor administrative access to the WordPress dashboard and review plugin submissions for suspicious characters or script tags in hidden fields.