Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder (<= 1.15.50)

The Form Maker by 10Web WordPress plugin up to version 1.15.50 contains a stored XSS vulnerability that allows unauthenticated attackers to inject malicious scripts into hidden input fields, which execute when an administrator interacts with the map view feature.