Form Maker by 10Web WordPress plugin stored XSS via submission fields
Anyone can plant code that runs when an admin opens form submissions.
Summary
The Form Maker by 10Web WordPress plugin does not properly escape submitted field values, so unauthenticated users can store a malicious script. The script runs in an administrator's session when they view the submissions.
Affected when
- An administrator views the form submissions page
What to do
Update to 1.15.51 or later.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen