CVE-2023-45070 HIGH

CVE-2023-45070: WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)

Vendor 10Web Form Builder Team
Product Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Weakness CWE-79 · XSS
Published October 18, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Form Maker by 10Web contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.15.18. An attacker can inject malicious scripts into form fields that execute when site visitors or administrators view the form. The vulnerability requires user interaction to trigger and can affect multiple users across the site.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts into forms that run in visitors' browsers, stealing session cookies or redirecting users.

Potential impact on your site

04Site Impact

Attackers can compromise visitor accounts, steal data, or redirect users to malicious sites through your contact forms.

Conditions required to exploit

05Prerequisites

No authentication required. A site visitor must view a form containing the injected payload.

Key dates

06Disclosure timeline

October 18, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-13425 Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values CVE-2026-65762 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 CVE-2026-13362 SendPulse Email Marketing Newsletter <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta CVE-2026-12939 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute CVE-2026-65538 WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability