What the vulnerability does
01Description
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.
Explanation of Vulnerability in Simple Terms
02Summary
Form Maker by 10Web contains an unrestricted file upload vulnerability affecting versions up to 1.15.35. An attacker can upload arbitrary files to the server without authentication. This can lead to unauthorized file storage and potential site compromise. Update to a version newer than 1.15.35 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the server without authentication.
Potential impact on your site
04Site Impact
Attackers can store malicious files on your server, potentially leading to code execution or data theft.
Conditions required to exploit
05Prerequisites
Network access to the form upload endpoint; no authentication or user interaction required.
Key dates
06Disclosure timeline
February 3, 2026
CVE published
April 8, 2026
Record updated
