CVE-2026-105413 · Package
NO FIX YET · SEE WHAT TO DO
The Form Maker by 10Web WordPress plugin does not escape user-submitted field values before showing them on its submissions admin page. An unauthenticated visitor can store a script that runs in the browser session of an administrator who views the submissions.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Form Maker by 10Web WordPress plugin below version 1.15.51 that accept public form submissions. The risk is to administrators who open the submissions page, so sites with no public forms or no admin review of submissions are less exposed. Sources do not give more detail on configuration.
Not affected if no-public-forms, plugin-version-1.15.51-or-later
Who cares 10web, form-maker, self-hosted, wordpress
wp plugin get form-maker --field=version1.15.51 or later (the sources say 'before 1.15.51' is affected)The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.