rootpwn

high · CVSS v3 7.2

CVE-2026-96813

The Form Maker plugin for WordPress is vulnerable to stored XSS via map longitude/latitude fields. Unauthenticated attackers can inject scri

Overview

The Form Maker plugin for WordPress is vulnerable to stored XSS via map longitude/latitude fields. Unauthenticated attackers can inject scripts that run when users view affected pages. This can lead to defacement, cookie theft, or malicious redirects.

Description

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Impact

Stored XSS can compromise confidentiality by stealing session cookies, integrity by allowing content tampering, and availability if malicious scripts disrupt page functionality. Site visitors and administrators are the primary impacted parties.

Remediation

Update the plugin to version 1.15.48 or later. If update is not possible, disable or remove the map fields, or apply input sanitization and output escaping. Implement a Content Security Policy to block inline scripts and use a web application firewall to filter XSS payloads.

Risk context

High severity (CVSS 7.2) with no EPSS data. The vulnerability is exploitable by unauthenticated users, making it a priority for immediate patching.

Affected products

  • 10Web Form Maker
  • WordPress Form Maker plugin

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.2
CVSS v4
—
EPSS
—

XSS WordPress FormMaker StoredXSS InputSanitization WebSecurity HighSeverity

← All CVEs

Related CVEs

high

CVE-2026-96780

CVE-2026-96780 is a high‑severity denial‑of‑service vulnerability in figlet.js that can cause an unbounded loop when whitespaceBreak is enabled and the width parameter is too small. The loop consumes CPU and memory, potentially exhausting system resources. It affects applications that use figlet.js versions prior to 1.11.3.

View analysis

high

CVE-2026-79899

Fortra BoKS Manager's bccgethostcert utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master with read access to BOKS_tmp may be able to access CA secret or host private-key material while the utility runs or from files left behind after certificate creation. This matters because exposure of CA or host private keys can undermine certificate trust and related access controls.

View analysis

high

CVE-2026-94390

The Hide Shipping Method For WooCommerce plugin (v1.5.4 and earlier) contains a PHP Object Injection flaw that can be exploited by attackers to execute arbitrary code on a WordPress site. This vulnerability allows attackers to compromise the confidentiality, integrity, and availability of the affected e‑commerce store. It is relevant to any WordPress site that has the plugin installed and not patched.

View analysis

high

CVE-2026-95588

CVE-2026-95588 is an unauthenticated arbitrary file deletion vulnerability affecting AcyMailing SMTP Newsletter versions 11.0.5 and earlier. It matters because an attacker may be able to delete files on the application server without authentication, potentially disrupting service or weakening security controls.

View analysis