{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/form-maker-by-10web--mobile-friendly-drag--drop-contact-form-builder--1.15.50/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:10web:form_maker:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"id":"CVE-2026-120512"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Form Maker by 10Web – Mobile-Friendly Drag \u0026 Drop Contact Form Builder (\u003c= 1.15.50)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["10Web"],"content_html":"\u003cp\u003eThe Form Maker by 10Web WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in hidden input fields (parameters formatted as \u003ccode\u003ewdform_\u0026lt;n\u0026gt;_element\u0026lt;id\u0026gt;\u003c/code\u003e). An unauthenticated attacker can submit malicious payloads through contact forms. The script executes in the context of an administrator's session when they view the submissions screen and select the \u0026quot;Show-on-Map\u0026quot; feature for a malicious entry. This process bypasses nonces and capability checks by utilizing the administrator's own active session and the \u003ccode\u003efm_ajax_nonce\u003c/code\u003e provided by the application.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target WordPress site running a vulnerable version of the Form Maker plugin.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious form submission containing XSS payloads within hidden input fields.\u003c/li\u003e\n\u003cli\u003eAttacker submits the form to the target application.\u003c/li\u003e\n\u003cli\u003eThe plugin stores the payload in the database without proper sanitization.\u003c/li\u003e\n\u003cli\u003eAn administrator navigates to the 'Submissions' screen within the WordPress dashboard.\u003c/li\u003e\n\u003cli\u003eThe administrator interacts with the 'Show-on-Map' link associated with the malicious submission.\u003c/li\u003e\n\u003cli\u003eThe application echoes the payload unescaped into a JavaScript string within the \u003ccode\u003eFormMakerEditCountryinPopup\u003c/code\u003e popup.\u003c/li\u003e\n\u003cli\u003eThe malicious script executes in the administrator's browser, potentially allowing account takeover or further administrative actions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary script execution in an administrator's browser context, potentially leading to unauthorized administrative actions, sensitive data access, or account takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;Form Maker by 10Web - Mobile-Friendly Drag \u0026amp; Drop Contact Form Builder\u0026quot; plugin to the latest available version (beyond 1.15.50) to ensure the sanitization fix is applied.\u003c/li\u003e\n\u003cli\u003eImplement or enforce Content Security Policy (CSP) headers to mitigate the impact of XSS vulnerabilities.\u003c/li\u003e\n\u003cli\u003eMonitor administrative access to the WordPress dashboard and review plugin submissions for suspicious characters or script tags in hidden fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T03:46:33Z","date_published":"2026-11-07T03:46:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-form-maker-xss/","summary":"The Form Maker by 10Web WordPress plugin up to version 1.15.50 contains a stored XSS vulnerability that allows unauthenticated attackers to inject malicious scripts into hidden input fields, which execute when an administrator interacts with the map view feature.","title":"Form Maker by 10Web: Stored Cross-Site Scripting (CVE-2026-120512)","url":"https://feed.craftedsignal.io/briefs/2026-11-form-maker-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Form Maker by 10Web – Mobile-Friendly Drag \u0026 Drop Contact Form Builder (\u003c= 1.15.50)","version":"https://jsonfeed.org/version/1.1"}