CVE-2026-103998
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to and including 1.15.48 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link.
Risk Assessment
The risk includes the possibility of executing malicious scripts in the victim's browser after clicking a crafted link, which could lead to data theft, session hijacking, or malware distribution. The attack can affect any user who clicks on the malicious link.
Recommendation
Update the Form Maker by 10Web plugin to the latest patched version. Also educate users not to click on suspicious links and consider adding Content Security Policy (CSP) headers to mitigate XSS impacts.
Other vulnerabilities in Form Maker by 10Web
See all- CVE-2026-3359High
The Form Maker by 10Web, a plugin for creating contact forms in WordPress, is vulnerable to SQL Injection via the 'inputs' parameter in versions up to and including 1.15.42. This is due to insufficient escaping of user-supplied parameters and lack of proper preparation of the existing SQL query.
- CVE-2026-39502Critical
There is an unauthenticated SQL injection vulnerability in Form Maker by 10Web versions up to 1.15.38.
- CVE-2026-96813High
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-85645Medium
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- CVE-2026-66616High
The Form Maker by 10Web plugin (versions up to 1.15.49) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. Malicious JavaScript submitted through a form is stored and executed when a user visits the affected page.
- CVE-2026-15993Medium
The Form Maker by 10Web plugin for WordPress up to version 1.15.44 is vulnerable to blind SQL injection via the '{username}' placeholder in a dynamic-choice field. Authenticated attackers with subscriber-level access can append additional SQL queries to extract sensitive information from the database.
- CVE-2026-16977High
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
- CVE-2026-11777Medium
The Form Maker by 10Web, a plugin for creating contact forms in WordPress, is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to and including 1.15.43. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.
- CVE-2026-11776Medium
The Form Maker by 10Web, a plugin for creating contact forms in WordPress, is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to and including 1.15.43. This issue arises from insufficient escaping of the user-supplied parameter and lack of proper preparation of the existing SQL query.
- CVE-2025-15441Medium
The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.
Original NVD description (English source)
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to, and including, 1.15.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS