{"id":"CVE-2026-105413","kind":"vulnerability","aliases":["CVE-2026-105413"],"related":[],"title":"WordPress Form Maker plugin: unescaped submissions let visitors run scripts in admin","description":"The Form Maker by 10Web  WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.","summary":"The Form Maker by 10Web WordPress plugin does not escape user-submitted field values before showing them on its submissions admin page. An unauthenticated visitor can store a script that runs in the browser session of an administrator who views the submissions.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["10web","form-maker","package","self-hosted","wordpress"],"not_affected_if":["no-public-forms","plugin-version-1.15.51-or-later"],"how_to_check":"- Check the installed version of the Form Maker by 10Web plugin in the WordPress admin plugins list or `wp plugin get form-maker --field=version`\n- Confirm whether the site accepts public form submissions that administrators later review in the submissions page","fix":"- Form Maker by 10Web: move to version `1.15.51` or later (the sources say 'before 1.15.51' is affected)","status":"open","published_at":"2026-11-04T06:16:57+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","triaged_at":"2026-11-04T06:26:34+00:00","updated_at":"2026-11-04T06:26:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:34Z","model":"claude-haiku-5-5","output":{"fix":"- Form Maker by 10Web: move to version `1.15.51` or later (the sources say 'before 1.15.51' is affected)","reach":"internet","title":"WordPress Form Maker plugin: unescaped submissions let visitors run scripts in admin","impact":"medium","summary":"The Form Maker by 10Web WordPress plugin does not escape user-submitted field values before showing them on its submissions admin page. An unauthenticated visitor can store a script that runs in the browser session of an administrator who views the submissions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","form-maker","10web","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"script runs in an administrator's session on the WordPress site","analyst_note":"","how_to_check":"- Check the installed version of the Form Maker by 10Web plugin in the WordPress admin plugins list or `wp plugin get form-maker --field=version`\n- Confirm whether the site accepts public form submissions that administrators later review in the submissions page","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-1.15.51-or-later","no-public-forms"],"who_is_affected":"Sites running the Form Maker by 10Web WordPress plugin below version 1.15.51 that accept public form submissions. The risk is to administrators who open the submissions page, so sites with no public forms or no admin review of submissions are less exposed. Sources do not give more detail on configuration.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4119,"output_tokens":566,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105413':15A,18A '-2026':14A,17A '1.15.51':79C '10web':19B,32B,75C 'admin':12A,49B,95C 'administr':66B,115C 'allow':97C 'arbitrari':107C 'browser':62B 'consist':82C 'cve':13A,16A 'escap':37B,83C 'execut':105C 'field':41B,87C 'form':2A,21B,29B,72C 'form-mak':20B 'host':26B 'let':7A 'maker':3A,22B,30B,73C 'packag':23B 'page':50B,96C 'payload':103C 'plugin':4A,34B,77C 'render':90C 'run':9A,59B 'script':10A,57B,109C 'self':25B 'self-host':24B 'session':63B,112C 'show':44B 'store':55B,101C 'submiss':6A,48B,70B,94C,119C 'submit':40B,86C 'unauthent':52B,98C 'unescap':5A 'user':39B,85C,99C 'user-submit':38B,84C 'valu':42B,88C 'view':68B,117C 'visitor':8A,53B 'web':108C 'wordpress':1A,27B,33B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Form Maker by 10Web WordPress plugin below version 1.15.51 that accept public form submissions. The risk is to administrators who open the submissions page, so sites with no public forms or no admin review of submissions are less exposed. Sources do not give more detail on configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["10web","formmaker","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105413","severity":null,"published_at":"2026-11-04T06:16:57+00:00","modified_at":"2026-11-04T06:16:57+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","fetched_at":"2026-11-04T06:25:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}